Drupal up to 10.5.8/10.6.6/11.2.10/11.3.6 dynamically-determined object attributes

Summaryinfo

A vulnerability classified as problematic has been found in Drupal up to 10.5.8/10.6.6/11.2.10/11.3.6. The affected element is an unknown function. Performing a manipulation results in dynamically-determined object attributes. This vulnerability is known as CVE-2026-6366. Remote exploitation of the attack is possible. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Drupal up to 10.5.8/10.6.6/11.2.10/11.3.6. This affects some unknown processing. The manipulation with an unknown input leads to a dynamically-determined object attributes vulnerability. CWE is classifying the issue as CWE-915. The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified. This is going to have an impact on integrity. The summary by CVE is:

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.

The weakness was published by Truong Le as sa-core-2026-002. It is possible to read the advisory at drupal.org. This vulnerability is uniquely identified as CVE-2026-6366 since 04/15/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 10.5.9, 10.6.7, 11.2.11 or 11.3.7 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Content Management System

Name

• Drupal

Version

• 10.5.0
• 10.5.1
• 10.5.2
• 10.5.3
• 10.5.4
• 10.5.5
• 10.5.6
• 10.5.7
• 10.5.8
• 10.6.0
• 10.6.1
• 10.6.2
• 10.6.3
• 10.6.4
• 10.6.5
• 10.6.6
• 11.2.0
• 11.2.1
• 11.2.2
• 11.2.3
• 11.2.4
• 11.2.5
• 11.2.6
• 11.2.7
• 11.2.8
• 11.2.9
• 11.2.10
• 11.3.0
• 11.3.1
• 11.3.2
• 11.3.3
• 11.3.4
• 11.3.5
• 11.3.6

License

• open-source

Website

• Product: https://www.drupal.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion