Object Injection Vulnerability in Drupal ECA: Event - Condition - Action
CVE-2026-15083

4.2MEDIUM

Key Information:

Vendor

Drupal
Status
Eca: Event - Condition - Action
Vendor
CVE Published:
10 July 2026

What is CVE-2026-15083?

The vulnerability in Drupal's ECA: Event - Condition - Action allows an attacker to manipulate object attributes improperly, leading to potential object injection. This affects versions 0.0.0 to 2.1.20, 3.0.0 to 3.0.12, and 3.1.0 to 3.1.4. Users are advised to assess their installation and apply the necessary updates to mitigate risks associated with this vulnerability.

Affected Version(s)

ECA: Event - Condition - Action 0.0.0 < 2.1.20

ECA: Event - Condition - Action 3.0.0 < 3.0.12

ECA: Event - Condition - Action 3.1.0 < 3.1.4

References

https://www.drupal.org/sa-contrib-2026-074

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Changhai Qi (qichanghai)
Jürgen Haas (jurgenhaas)
Neil Drumm (drumm)
Greg Knaddison (greggles)
Dave Long (longwave)
.