Object Injection Flaw in Drupal Monster Menus by Drupal
CVE-2026-114573

8.8HIGH

Key Information:

Vendor

Drupal
Status
Monster Menus
Vendor
CVE Published:
30 October 2026

What is CVE-2026-114573?

The Drupal Monster Menus component is susceptible to an Object Injection vulnerability due to improperly controlled modification of dynamically-determined object attributes. This flaw allows attackers to manipulate object attributes, which can lead to potential exploitation and unauthorized access. Versions 0.0.0 through 9.5.6 are impacted. It is crucial for users to patch affected versions to prevent security breaches.

Affected Version(s)

Monster Menus 0.0.0 < 9.5.6

References

https://www.drupal.org/sa-contrib-2026-253

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Drew Webber (mcdruid)
Dan Wilga (gribnif)
Drew Webber (mcdruid)
.