CVE-2026-55803

CVE Enrichment

CVSS: 5.9 MEDIUM
EPSS: 0.35%
EPSS Percentile: 26.92%
CISA KEV: Not listed

Description

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: mlhess@drupal.org
Published: 11-Jul-2026 05:16
Last Modified: 16-Jul-2026 22:09
EPSS Date: 2026-10-10
CWE: CWE-915

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:H /
                            PR:H /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:N

Affected Products / Versions

drupal / drupal
Version / affected range: * · before (exclusive) 10.5.12
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
drupal / drupal
Version / affected range: * · from (inclusive) 10.6.0 · before (exclusive) 10.6.11
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
drupal / drupal
Version / affected range: * · from (inclusive) 11.0.0 · before (exclusive) 11.2.14
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
drupal / drupal
Version / affected range: * · from (inclusive) 11.3.0 · before (exclusive) 11.3.12
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*

References

mlhess@drupal.org

Last enrichment sync: 11-Oct-2026 15:00
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

web extensions and open-source projects, resulting in 12 assigned CVEs, including CVE-2026-13242, CVE-2026-55803, and an additional dozen currently in active disclosure. Mandiant Details AI-Assisted Harness for Finding Source-Code Vulnerabilities

CVE (1)

People (2)

Vendors (2)

Products (5)

Tools (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.