{"id":"CVE-2026-55804","published":"2026-07-10T21:46:39Z","modified":"2026-07-13T18:23:35Z","title":"Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006","vendor":"Drupal","product":"Drupal core","tier":"tail","description":{"text":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.9,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00353,"percentile":0.28807,"provenance":"source"},"cwes":[{"id":"CWE-915","name":"Improperly Controlled Modification of Dynamically-Determined Object Attributes"}],"references":[{"url":"https://www.drupal.org/sa-core-2026-006","tags":[]}],"priority":{"score":9.9,"factors":[{"name":"EPSS percentile","points":5.76},{"name":"CVSS severity","points":4.13}]},"vendorSlug":"drupal","affectedVersions":[{"vendor":"Drupal","product":"Drupal core","versions":[">= 0.0.0, < 10.5.12",">= 10.6.0, < 10.6.11",">= 11.2.0, < 11.2.14",">= 11.3.0, < 11.3.12",">= 0.0.0, < 11.0.*",">= 0.0.0, < 11.1.*"]}],"affected":[{"ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":["<10.5.12",">=10.6.0, <10.6.11",">=11.2.0, <11.2.14",">=11.3.0, <11.3.12",">=11.0.0, <11.1.0",">=11.1.0, <11.2.0"],"patched":["10.5.12","10.6.11","11.2.14","11.3.12","11.1.0","11.2.0"],"from":["DRUPAL-CORE-2026-006"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-43082","exploited":false,"provenance":"source"}}