Drupal Core CVE-2026-6366

Exploitation is limited to users with administrator-level privileges on the Drupal installation, confirmed by CVSS PR:H - anonymous users, authenticated editors, or other non-admin roles cannot trigger this vulnerability. In addition, CVSS AC:H confirms that high attack complexity applies: exploitation is not achievable reliably against all configurations and likely requires specific site states, configurations, or sequencing of actions beyond simply possessing admin credentials. The scope is unchanged (S:U), meaning the vulnerability does not inherently allow escape from the Drupal application to the underlying server without additional chaining. No user interaction is required (UI:N), so a malicious administrator can exploit this unilaterally. The primary limiting factors are the administrator privilege requirement and high complexity, which together prevent opportunistic or mass exploitation.

The CVSS base score of 6.6 (Medium) reflects a genuine tension between severe potential impact (C:H/I:H/A:H) and constrained exploitability. The AC:H (High Complexity) component indicates that successful exploitation is not straightforward and likely depends on race conditions, specific configuration states, or a multi-step attack sequence. More significantly, PR:H (High Privileges Required) confirms that only administrator-level authenticated users can trigger this vulnerability - anonymous or low-privilege users are not an attack surface. No EPSS score was provided in the available intelligence, so probabilistic exploitation likelihood cannot be quantified. KEV status is not confirmed and no POC has been identified, making this a credible but currently theoretical risk rather than an actively weaponized threat. The realistic threat model centers on insider threats, compromised admin accounts, or privilege escalation chains - not external mass exploitation. The high impact scores should not overshadow the significant privilege barrier.

An attacker who has gained administrator-level access to a vulnerable Drupal site - whether through credential theft, phishing, or a prior privilege escalation - sends a specially crafted network request that supplies attacker-controlled values to a dynamically resolved object attribute assignment path in Drupal core. The high attack complexity (AC:H) suggests the attacker must meet additional conditions, such as a specific module being enabled or particular site configuration, before the injection is triggered. If successful, the attacker achieves object injection that can be chained into arbitrary code execution with full site compromise, affecting all data and functionality. No public exploit code is known at time of analysis.