SA-CONTRIB-2026-012: Theme Negotiation by Rules CSRF — GET Requests That Mutate State

On February 25, 2026, Drupal published SA-CONTRIB-2026-012 for Theme Negotiation by Rules (drupal/theme_rule), tracked as CVE-2026-3211. The vulnerability: enable/disable actions for theme rules fire through GET requests. No CSRF token required. 🚨 ...