{"id":"CVE-2026-6366","published":"2026-05-19T22:27:46Z","modified":"2026-05-21T03:55:14Z","title":"Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002","vendor":"Drupal","product":"Drupal core","tier":"tail","description":{"text":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.\n\nThis issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.6,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00399,"percentile":0.34046,"provenance":"source"},"cwes":[{"id":"CWE-915","name":"Improperly Controlled Modification of Dynamically-Determined Object Attributes"}],"references":[{"url":"https://www.drupal.org/sa-core-2026-002","tags":[]}],"priority":{"score":11.4,"factors":[{"name":"EPSS percentile","points":6.81},{"name":"CVSS severity","points":4.62}]},"vendorSlug":"drupal","affectedVersions":[{"vendor":"Drupal","product":"Drupal core","versions":[">= 8.0.0, < 10.5.9",">= 10.6.0, < 10.6.7",">= 11.0.0, < 11.2.11",">= 11.3.0, < 11.3.7"]}],"affected":[{"ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":[">=8.0.0, <10.5.9",">=10.6.0, <10.6.7",">=11.0.0, <11.2.11",">=11.3.0, <11.3.7"],"patched":["10.5.9","10.6.7","11.2.11","11.3.7"],"from":["GHSA-xmjc-63pr-2mpg","DRUPAL-CORE-2026-002"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-30999","exploited":false,"provenance":"source"}}