Drupal ECA EUVD-2026-43078

Exploitation requires a valid Drupal account with at least low-privileged access, as confirmed by the CVSS PR:L metric - fully unauthenticated attackers cannot exploit this vulnerability. Attack complexity is rated High (AC:H), meaning a specific configuration, internal object state, or traversal condition within ECA must be satisfied; the exact triggering requirement is not disclosed in the available advisory. The ECA module must be installed and active on the target Drupal instance, and the installed version must fall within the vulnerable ranges: 0.0.0-2.1.20, 3.0.0-3.0.12, or 3.1.0-3.1.4. The unchanged scope (S:U) confirms exploitation does not cross Drupal application boundaries. Sites that restrict ECA-related permissions exclusively to administrator roles materially raise the bar for exploitation beyond what the base CVSS score implies.

The CVSS base score of 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) reflects a constrained but genuine risk: the vulnerability is network-reachable and requires no user interaction, but demands authenticated access at low privilege level and high attack complexity. EPSS at 0.20% (10th percentile) corroborates minimal observed exploitation pressure, and the vulnerability is absent from the CISA KEV catalog with no public exploit code identified at time of analysis. Taken together, these signals indicate this is not a mass-exploitation candidate in the near term. However, Drupal sites that grant broad contributor-level authenticated access should treat this as a meaningful integrity concern given ECA's role in automating business-critical workflows - an attacker able to manipulate workflow conditions or actions could subvert automated processes in ways disproportionate to the CVSS score alone. The AC:H constraint is the primary suppressor of real-world risk.

An authenticated low-privileged Drupal user - such as a contributor or editor with access to ECA-exposed endpoints - crafts a request that injects unexpected object attributes into a dynamically-constructed ECA object during event processing. By exploiting the insufficient property allowlisting, the attacker manipulates internal object state to read restricted data or alter ECA workflow outcomes such as condition evaluations or action parameters. High attack complexity means the attacker must possess knowledge of the target's specific ECA object structure and find a viable injection path, making this more plausible as a targeted insider threat than opportunistic automated scanning.