CVE-2026-55809

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issue affects Flag attendance field versions: from 0.0.0 to 1.2.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.drupal.org/sa-contrib-2026-049	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:flag_attendance_field_project:flag_attendance_field:*:*:*:*:*:drupal:*:*

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de Modificación Incontrolada de Atributos de Objeto Determinados Dinámicamente en el campo Flag attendance de Drupal permite la Inyección de Objetos. Este problema afecta a las versiones del campo Flag attendance: desde la 0.0.0 hasta la 1.2.

Information

Published : 2026-07-10 22:16

Updated : 2026-10-25 15:10

NVD link : CVE-2026-55809

Mitre link : CVE-2026-55809

CVE.ORG link : CVE-2026-55809

JSON object : View

Products Affected

flag_attendance_field_project

flag_attendance_field

CWE

CWE-915

Improperly Controlled Modification of Dynamically-Determined Object Attributes

{"id": "CVE-2026-55809", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55809", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-13T18:11:21.944969Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "mlhess@drupal.org", "affectedData": [{"repo": "https://git.drupalcode.org/project/flag_attendance_field", "vendor": "Drupal", "product": "Flag attendance field", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "1.2", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/flag_attendance_field"}]}], "published": "2026-07-10T22:16:43.763", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-049", "tags": ["Vendor Advisory"], "source": "mlhess@drupal.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "mlhess@drupal.org", "description": [{"lang": "en", "value": "CWE-915"}]}], "descriptions": [{"lang": "en", "value": "Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issue affects Flag attendance field versions: from 0.0.0 to 1.2."}, {"lang": "es", "value": "Vulnerabilidad de Modificaci\u00f3n Incontrolada de Atributos de Objeto Determinados Din\u00e1micamente en el campo Flag attendance de Drupal permite la Inyecci\u00f3n de Objetos. Este problema afecta a las versiones del campo Flag attendance: desde la 0.0.0 hasta la 1.2."}], "lastModified": "2026-10-25T15:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:flag_attendance_field_project:flag_attendance_field:*:*:*:*:*:drupal:*:*", "vulnerable": true, "matchCriteriaId": "EBE062E8-AC29-493C-8EF2-02372FE92C5B", "versionEndExcluding": "1.2"}], "operator": "OR"}]}], "sourceIdentifier": "mlhess@drupal.org"}