Drupal's 19/25 Rating and CVE-2026-108099: Reconciling Module Risk With CVSS 8.1

Drupal has assigned a critical rating of 19 out of 25 to a vulnerability in the Entity List module. The Common Vulnerabilities and Exposures (CVE) record for this issue, CVE-2026-108099, lists a Common Vulnerability Scoring System (CVSS) 3.1 score of 8.1. These two ratings may seem conflicting at first glance, but their differences stem from their distinct purposes and scopes.

The Drupal rating takes into account various factors including access conditions, authentication requirements, confidentiality, integrity, availability, exploit maturity, and target distribution. This comprehensive approach has resulted in the critical classification of the issue. On the other hand, the CVSS 3.1 score provides a technical severity calculation based on attack vector, authentication, confidentiality, integrity, and availability impact.

A higher complexity in the attack process can lower the score, even if the potential impact remains significant.

It is crucial to understand that neither the Drupal rating nor the CVSS score implies that every Drupal site is vulnerable. Instead, the advisory states that the Entity List module before version 3.0.10 is affected. Furthermore, the module alone is not directly exploitable; other contributed modules or custom code must expose the vulnerable functionality. Importantly, at least one known path does not require authentication.

The patch for this vulnerability is available in Entity List version 3.0.10. Therefore, updating the module to this version is the recommended action. While waiting for a proof of concept could expose the vulnerable code longer than necessary, the practical decision is to treat any site with the vulnerable module as requiring an update. This approach should be complemented by a reachability review to determine if additional containment is needed for custom or contributed integrations.

When communicating about this issue, it is essential to avoid two unsupported statements. First, Entity List is not installed everywhere; it is only installed on sites that have incorporated the module or its integrations. Second, the CVSS score being below 9 does not mean that the issue can wait. It is important to clarify that the vulnerability can lead to remote code execution through other code and has at least one known unauthenticated exploit path.

According to the public advisory, CVE-2026-108099 affects Entity List versions before 3.0.10, potentially leading to remote code execution through other code. The public advisory does not disclose the full exploitation chain, but Drupal has rated the risk as critical and the CVE record describes a high-impact reflection injection.

The patch for this vulnerability is available, and the entity should be updated promptly. To find affected sites, use local inventory to locate Entity List versions and review source code to identify integrations that accept untrusted class selections. Finally, use deployment verification to ensure that version 3.0.10 is active and record any residual uncertainty before declaring the issue resolved.