What is the CVSS score of CVE-2026-55810?

CVE-2026-55810 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Plotly.js Graphing are affected by CVE-2026-55810?

The Drupal Plotly.js Graphing module (versions 0.0.0-3.0.2) contains a high-severity object injection vulnerability (CVE-2026-55810, CVSS 8.1) allowing low-privilege authenticated users to manipulate…. A patch is available.

How to fix or mitigate CVE-2026-55810?

Within 24 hours: Conduct a complete inventory of all Drupal instances running Plotly.js Graphing module versions 0.0.0 through 3.0.2, documenting the count of affected systems and the number of authenticated users who can access chart creation. Within 7 days: Apply the vendor-released patch to all affected instances per the official Drupal security advisory, or disable the module if patching cannot be completed by this deadline. Within 30 days: Verify successful patch deployment across all systems, audit graphing activity logs dating back 30 days for any unauthorized data modifications, and implement role-based access controls restricting chart creation to administrative or trusted users where operationally feasible.

Plotly.js Graphing CVE-2026-55810

EUVD-2026-43054 HIGH

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

2026-07-10 drupal

GHSA-gr6q-5p85-fq4q

Code Injection Drupal Red Hat Plotly Js Graphing

8.1

CVSS 3.1 · Vendor: drupal

Severity by source

Vendor (drupal) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Web-reachable module needs a low-privilege authenticated account (PR:L) and no interaction; object injection enables data disclosure and tampering (C:H/I:H) but no service outage (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Red Hat

8.1 HIGH

qualitative

Primary rating from Vendor (drupal).

CVSS VectorVendor: drupal

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 13, 2026 - 19:32 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 13, 2026 - 19:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 13, 2026 - 19:22 vuln.today

cvss_changed

Severity Changed

Jul 13, 2026 - 19:22 NVD

CRITICAL HIGH

CVSS changed

Jul 13, 2026 - 19:22 NVD

9.8 (CRITICAL) 8.1 (HIGH)

Analysis Generated

Jul 13, 2026 - 19:09 vuln.today

CVSS changed

Jul 13, 2026 - 19:07 NVD

9.8 (CRITICAL)

Patch available

Jul 10, 2026 - 23:02 EUVD

CVE Published

Jul 10, 2026 - 21:44 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 10, 2026 - 21:44 cve.org

CRITICAL 9.8

DescriptionCVE.org

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue affects Plotly.js Graphing versions: from 0.0.0 to 3.0.2.

AnalysisAI

Object injection in the Drupal Plotly.js Graphing contributed module (all releases 0.0.0 through 3.0.2) lets an authenticated attacker with low privileges tamper with dynamically-determined object attributes, undermining both confidentiality and integrity of the site. The flaw stems from improperly controlled modification of object properties (CWE-915), and the network-reachable, low-complexity CVSS 3.1 vector (8.1) reflects meaningful severity; however, EPSS is only 0.16% (6th percentile) and no public exploit identified at time of analysis. It is not listed in CISA KEV.

Technical ContextAI

Plotly.js Graphing is a Drupal contributed module that integrates the Plotly.js JavaScript charting library into Drupal so site builders can render interactive graphs from field or view data (CPE cpe:2.3:a:drupal:plotly.js_graphing). The root cause is CWE-915, Improperly Controlled Modification of Dynamically-Determined Object Attributes - often called object/property injection or mass assignment. This class arises when attacker-influenced keys are used to set object properties without an allow-list, letting an attacker overwrite internal attributes (configuration, control flags, or object state) that were never meant to be user-controllable, which in a PHP/Drupal context can corrupt entity or configuration objects processed during graph rendering.

RemediationAI

Patch available per vendor advisory: upgrade the Plotly.js Graphing module to the fixed release published in Drupal SA-CONTRIB-2026-050 (https://www.drupal.org/sa-contrib-2026-050), which supersedes the vulnerable 0.0.0-3.0.2 range; the exact fixed version is not specified in the provided data, so confirm the current recommended release on the module's project page before deploying. Until the update is applied, reduce exposure by tightening account provisioning and permissions so that only trusted, minimally necessary roles can reach the module's graph-configuration or data-submission features (since exploitation requires an authenticated low-privilege account), and consider temporarily disabling or uninstalling the Plotly.js Graphing module if the charts are non-essential - the trade-off is loss of graph rendering on affected pages. Placing the module's endpoints behind additional access review or a WAF rule that constrains unexpected object-key parameters can add defense while the patch is scheduled.