CVE-2026-3211

The Drupal Theme Negotiation by Rules module is vulnerable to a Cross-Site Request Forgery (CSRF) attack in versions prior to 1.2.1 . The root cause is the use of simple GET requests to enable or disable "theme_rule" config entities, which allow site builders to render different themes based on s...