Executive brief
The Drupal Salesforce Suite, which synchronizes website data with Salesforce CRM, contains a security flaw in its authentication process. An attacker could trick a site administrator into clicking a malicious link, allowing the attacker to hijack the connection between the website and Salesforce. This could result in the website being linked to an attacker-controlled Salesforce account, potentially leading to data being sent to the wrong destination or unauthorized access to CRM integration settings.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the salesforce_oauth submodule of the Drupal Salesforce Suite. The module fails to properly validate the OAuth handshake during interactive authentication. An attacker can exploit this by inducing an authenticated administrator to visit a malicious URL, allowing the attacker to hijack the authorization token and rebind the Drupal site's integration to an attacker-controlled Salesforce account. The vulnerability is mitigated by the requirement that the deprecated salesforce_oauth submodule must be enabled and in active use; sites using the newer salesforce_jwt plugin are not affected. The issue is fixed in version 5.1.3, and the vulnerable submodule has been entirely removed in the 6.0.x branch.
Affected products
- Drupal Salesforce Suite 0.0.0 to 5.1.2
Timeline
- 2026-06-24: patched: Version 5.1.3 released to address the vulnerability.
- 2026-06-24: advisory: Drupal security advisory SA-CONTRIB-2026-063 published.
- 2026-07-10: disclosed: CVE-2026-13243 published to the NVD.