What is the CVSS score of EUVD-2026-43053?

EUVD-2026-43053 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Flag Attendance Field are affected by EUVD-2026-43053?

The Drupal Flag attendance field module contains a HIGH-severity object injection vulnerability (CVSS 8.1) affecting versions 1.2 and earlier, allowing authenticated users with minimal privileges to…. A patch is available.

How to fix or mitigate EUVD-2026-43053?

Within 24 hours, identify and catalog all Drupal systems running Flag attendance field module versions 1.2 and earlier, and classify by business criticality. Within 7 days, deploy the vendor patch released in SA-CONTRIB-2026-049 to all affected instances, prioritizing production environments. Within 30 days, validate complete patch deployment across all systems, execute regression testing on attendance functionality, and document remediation completion.

Flag Attendance Field EUVD-2026-43053

| CVE-2026-55809 HIGH

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

2026-07-10 drupal

GHSA-66vp-2cwc-4pv3

Code Injection Drupal Flag Attendance Field

8.1

CVSS 3.1 · Vendor: drupal

Severity by source

Vendor (drupal) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Remote, low-complexity object injection reachable by an authenticated low-privileged user (PR:L) with no interaction; high confidentiality and integrity impact but no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (drupal).

CVSS VectorVendor: drupal

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 13, 2026 - 19:33 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 13, 2026 - 19:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 13, 2026 - 19:22 vuln.today

cvss_changed

Severity Changed

Jul 13, 2026 - 19:22 NVD

CRITICAL HIGH

CVSS changed

Jul 13, 2026 - 19:22 NVD

9.8 (CRITICAL) 8.1 (HIGH)

Analysis Generated

Jul 13, 2026 - 19:10 vuln.today

CVSS changed

Jul 13, 2026 - 19:07 NVD

9.8 (CRITICAL)

Patch available

Jul 10, 2026 - 23:02 EUVD

CVE Published

Jul 10, 2026 - 21:44 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 10, 2026 - 21:44 cve.org

CRITICAL 9.8

DescriptionCVE.org

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issue affects Flag attendance field versions: from 0.0.0 to 1.2.

AnalysisAI

Object injection in the Drupal contrib module Flag attendance field (all versions up to and including 1.2) lets an authenticated user with low privileges pass attacker-controlled data into a dynamically-determined object attribute (CWE-915), enabling PHP object injection and high-impact compromise of data confidentiality and integrity. The Drupal Security Team published advisory SA-CONTRIB-2026-049 and a fixed release is available. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.17%, 7th percentile).

Technical ContextAI

The affected component is Flag attendance field, a contributed module for the Drupal CMS (CPE cpe:2.3:a:drupal:flag_attendance_field). The root cause is CWE-915, Improperly Controlled Modification of Dynamically-Determined Object Attributes, commonly known in PHP as object injection: user-supplied input is used to set object properties or is passed through an unsafe deserialization/property-assignment path, allowing an attacker to instantiate or mutate objects whose attributes were meant to be internally controlled. In PHP/Drupal, this class of bug frequently maps to unserialize()-style gadget abuse or mass-assignment of object properties, which can pivot into arbitrary data manipulation, information disclosure, or code execution via POP gadget chains present in the framework.

RemediationAI

Patch available per vendor advisory: upgrade Flag attendance field to version 1.2 or later, which is the first release outside the affected 0.0.0-1.2 range, per Drupal Security Advisory SA-CONTRIB-2026-049 (https://www.drupal.org/sa-contrib-2026-049). If you cannot upgrade immediately, reduce exposure by uninstalling or disabling the Flag attendance field module (trading off loss of the attendance-flagging feature), and by tightening role and permission assignments so that only fully trusted accounts have the permissions needed to submit data through this field, since exploitation requires an authenticated low-privileged account. As a defense-in-depth measure, restrict or monitor account creation and self-registration and place the affected forms/endpoints behind additional access controls or a WAF rule inspecting for serialized PHP object payloads, accepting that WAF signatures for object injection are imperfect and may cause false positives; these are stopgaps only until the module is updated.