Object Injection Vulnerability in Drupal Core
CVE-2026-55804

5.9MEDIUM

Key Information:

Vendor

Drupal
Status
Drupal Core
Vendor
CVE Published:
10 July 2026

What is CVE-2026-55804?

This vulnerability in Drupal core arises from a lack of proper controls in the modification of dynamically-determined object attributes, allowing for potential object injection. Attackers exploiting this vulnerability could manipulate object attributes in unforeseen ways, potentially leading to additional security issues within applications built on affected versions of Drupal core.

Affected Version(s)

Drupal core 0.0.0 < 10.5.12

Drupal core 10.6.0 < 10.6.11

Drupal core 11.2.0 < 11.2.14

References

https://www.drupal.org/sa-core-2026-006

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michael Maturi (michaelmaturi)
Lee Rowlands (larowlan)
Drew Webber (mcdruid)
Mohit Aghera (mohit_aghera)
Anna Kalata (akalata)
Benji Fisher (benjifisher)
cilefen (cilefen)
Greg Knaddison (greggles)
Lee Rowlands (larowlan)
Dave Long (longwave)
Drew Webber (mcdruid)
Juraj Nemec (poker10)
Jess (xjm)
.