EUVD-2026-43078
GHSA-7h4c-w76p-j34c
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-reachable but high complexity and low-privilege authentication required; limited confidentiality and integrity impact with no availability effect and no scope change.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
4DescriptionCVE.org
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affects ECA: Event - Condition - Action versions: from 0.0.0 to 2.1.20, from 3.0.0 to 3.0.12, from 3.1.0 to 3.1.4.
AnalysisAI
Object injection in the Drupal ECA (Event - Condition - Action) contributed module exposes sites running affected versions to limited confidentiality and integrity compromise by authenticated low-privileged users. The vulnerability stems from improperly controlled modification of dynamically-determined object attributes (CWE-915, a mass-assignment class of flaw), allowing a crafted request to inject object properties and influence internal application logic within ECA's event-driven workflow engine. No confirmed active exploitation exists, and EPSS at 0.20% (10th percentile) reflects low observed threat pressure across the landscape, though a vendor patch has been issued per the Drupal security advisory.
Technical ContextAI
The ECA module for Drupal (CPE: cpe:2.3:a:drupal:eca:_event_-_condition_-_action:*:*:*:*:*:*:*:*) is a contributed workflow automation extension that implements event-driven logic through configurable condition and action chains, often consuming dynamic user or system input to drive automated site behaviors. CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes) describes a mass-assignment pattern where user-supplied data populates object properties without adequate allowlisting, enabling attackers to overwrite security-sensitive attributes not intended to be externally controlled. In Drupal's PHP runtime context, this can intersect with object injection patterns where manipulated object state influences downstream logic such as access checks, workflow branching, or action execution. The CVSS vector's AC:H rating indicates that exploitation is not straightforward and requires meeting specific internal conditions - possibly a particular ECA configuration, object traversal path, or application state - that are not trivially reproducible in generic scanning.
RemediationAI
Upgrade the ECA module to a fixed release per the vendor advisory at https://www.drupal.org/sa-contrib-2026-074. Based on the affected version boundaries, patched releases are expected beyond 2.1.20 for the 2.x branch, beyond 3.0.12 for the 3.0.x branch, and beyond 3.1.4 for the 3.1.x branch - however, exact released artifact version numbers should be confirmed directly from the Drupal advisory, as the upper boundaries of affected ranges are inferred and not independently verified. If immediate upgrade is not possible, restrict ECA configuration and execution permissions to the minimum set of trusted administrator-level Drupal roles, which reduces the authenticated surface area. As an additional compensating control, disabling any ECA workflows that accept external or user-controlled input can reduce exposure at the cost of losing automation functionality dependent on those workflows.
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today