EUVD-2026-43053
GHSA-66vp-2cwc-4pv3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged Drupal account
-
DeliveryAccess flag attendance field submission
-
ExploitCraft malicious serialized object payload
-
ExecutionTrigger dynamic attribute modification (object injection)
-
ImpactExfiltrate or tamper with sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V4 - API and Web Service Object attribute protection
|
| Exploitation Conditions | Exploitation requires the Flag attendance field module (version 0.0.0 through 1.2) to be installed and enabled on the target Drupal site, and the attacker must hold an authenticated account with the low-level privileges needed to submit data to the flag attendance field (CVSS PR:L). No user interaction is required (UI:N) and the attack is remote over the network (AV:N) with low complexity (AC:L). Limiting factors: the module is a niche contrib add-on that must be present, the account must have permission to reach the vulnerable field-submission path, and successful object injection depends on a usable POP gadget chain being reachable in the site's installed code - so a hardened site with minimal registration and restricted permissions materially reduces real-world risk. |
| Impact | The CVSS 3.1 base score is 8.1 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, indicating remote, low-complexity exploitation requiring some level of authentication (PR:L) and no user interaction, with high confidentiality and integrity impact but no availability impact. Countering that severity, the EPSS score is only 0.17% (7th percentile), the vulnerability is not on the CISA KEV list, and no POC has been surfaced in the provided intelligence - so this is a genuinely dangerous bug class but not currently associated with active or imminent mass exploitation. The PR:L requirement is the key mitigating factor: an attacker needs a foothold as an authenticated Drupal account with access to the flag/attendance functionality, which limits opportunistic exploitation. Net priority is moderate: patch promptly, but the low EPSS and authentication requirement mean this is not a drop-everything emergency for most sites, and object-injection impact can vary with the gadget chains actually reachable in a given deployment. |
| Exploit ScenarioDerived | An attacker registers or compromises a low-privileged Drupal account on a site running Flag attendance field and submits a crafted payload to the attendance flag field that manipulates a dynamically-determined object attribute, triggering PHP object injection. By supplying a serialized object matching an available gadget chain, the attacker reads or tampers with sensitive data (high confidentiality and integrity impact) without any user interaction. No public exploit code has been identified at time of analysis, so an attacker would need to develop the payload and a viable gadget chain themselves. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 13, 2026
Object injection in the Drupal contrib module Flag attendance field (all versions up to and including 1.2) lets an authenticated user with low privileges pass attacker-controlled data into a dynamically-determined object attribute (CWE-915), enabling PHP object injection and high-impact compromise of data confidentiality and integrity. The Drupal Security Team published advisory SA-CONTRIB-2026-049 and a fixed release is available. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.17%, 7th percentile).
Earlier versions of this analysis (2)
PHP object injection in the Drupal contributed module Flag attendance field (all versions from 0.0.0 through 1.2) lets a low-privileged authenticated user supply crafted serialized data that is deserialized into attacker-controlled objects, yielding high-confidentiality and high-integrity impact. The flaw is remotely reachable over the network with low complexity and no user interaction (CVSS 8.1). There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), so exploitation is not yet widespread.
Object injection in the Drupal contributed module Flag attendance field (versions 0.0.0 through 1.2) lets attackers improperly modify dynamically-determined object attributes (CWE-915), a class of flaw that commonly escalates to PHP object injection and remote code execution. NVD scores it CVSS 9.8 with a network, low-complexity, unauthenticated vector, but the very low EPSS probability (0.17%, 7th percentile) signals little real-world exploitation interest so far. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
Patch available per vendor advisory: upgrade Flag attendance field to version 1.2 or later, which is the first release outside the affected 0.0.0-1.2 range, per Drupal Security Advisory SA-CONTRIB-2026-049 (https://www.drupal.org/sa-contrib-2026-049). If you cannot upgrade immediately, reduce exposure by uninstalling or disabling the Flag attendance field module (trading off loss of the attendance-flagging feature), and by tightening role and permission assignments so that only fully trusted accounts have the permissions needed to submit data through this field, since exploitation requires an authenticated low-privileged account. As a defense-in-depth measure, restrict or monitor account creation and self-registration and place the affected forms/endpoints behind additional access controls or a WAF rule inspecting for serialized PHP object payloads, accepting that WAF signatures for object injection are imperfect and may cause false positives; these are stopgaps only until the module is updated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Flag attendance field, a contributed module for the Drupal CMS (CPE cpe:2.3:a:drupal:flag_attendance_field). The root cause is CWE-915, Improperly Controlled Modification of Dynamically-Determined Object Attributes, commonly known in PHP as object injection: user-supplied input is used to set object properties or is passed through an unsafe deserialization/property-assignment path, allowing an attacker to instantiate or mutate objects whose attributes were meant to be internally controlled. In PHP/Drupal, this class of bug frequently maps to unserialize()-style gadget abuse or mass-assignment of object properties, which can pivot into arbitrary data manipulation, information disclosure, or code execution via POP gadget chains present in the framework.
Know when Flag Attendance Field gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Remote, low-complexity object injection reachable by an authenticated low-privileged user (PR:L) with no interaction; high confidentiality and integrity impact but no availability effect.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
8DescriptionCVE.org
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issue affects Flag attendance field versions: from 0.0.0 to 1.2.
Executive ViewAI
The Drupal Flag attendance field module contains a HIGH-severity object injection vulnerability (CVSS 8.1) affecting versions 1.2 and earlier, allowing authenticated users with minimal privileges to manipulate sensitive data and access confidential records. Organizations deploying this contrib module face immediate data integrity and confidentiality risks. A vendor patch is available and should be deployed without delay.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Exploit-DB