← Back

CVE-2026-55804

nvd nist
Published: Jul 10, 2026Modified: Jul 16, 2026

JSON object

Loading...
5.9
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Exploitability: 0.7 / Impact: 5.2
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

Affected (4)

Products: Drupal: Drupal
Drupal
1 product
Drupal
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Drupal
Drupal
Before 10.5.12
Drupal
From 10.6.0 to 10.6.11
Drupal
From 11.0.0 to 11.2.14
Drupal
From 11.3.0 to 11.3.12

Related CWEs

CWE-915
Improperly Controlled Modification of Dynamically-Determined Object Attributes
The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

References (1)

Source: mlhess@drupal.org
Vendor Advisory

Timeline

No history available yet.