CVE-2026-55804 Overview
CVE-2026-55804 is an object injection vulnerability in Drupal core caused by improperly controlled modification of dynamically-determined object attributes [CWE-915]. Attackers with high privileges can manipulate object properties over the network to alter application state and compromise integrity or confidentiality. The issue affects Drupal core versions from 0.0.0 to 10.5.12, 10.6.0 to 10.6.11, 11.2.0 to 11.2.14, 11.3.0 to 11.3.12, 11.0.*, and 11.1.*. Drupal published advisory SA-CORE-2026-006 to address the flaw.
Critical Impact
Authenticated attackers can inject arbitrary object attributes to manipulate Drupal application logic, exposing sensitive data and corrupting integrity across affected sites.
Affected Products
- Drupal core 0.0.0 through 10.5.12 and 10.6.0 through 10.6.11
- Drupal core 11.0.*, 11.1.*, 11.2.0 through 11.2.14
- Drupal core 11.3.0 through 11.3.12
Discovery Timeline
- 2026-07-10 - CVE-2026-55804 published to NVD
- 2026-07-16 - Last updated in NVD database
Technical Details for CVE-2026-55804
Vulnerability Analysis
The vulnerability stems from Drupal core failing to restrict which object attributes can be modified based on untrusted input. When user-supplied data determines the target attribute of a PHP object at runtime, an attacker can overwrite properties never intended to be writable. This class of flaw, tracked under [CWE-915], enables object injection because Drupal instantiates or mutates objects using dynamic key names derived from request data.
Exploitation requires authenticated access with high privileges, which limits the attack surface to trusted users or compromised accounts. However, once a foothold exists, the attacker can pivot from restricted functionality to broader impact on confidentiality and integrity. Availability is not directly affected according to the published metrics.
The EPSS score is 0.215% at the 11.994 percentile, indicating low near-term likelihood of mass exploitation. Site operators should still remediate promptly because Drupal core vulnerabilities historically attract targeted exploitation once patches expose the code paths.
Root Cause
Drupal core accepts input that flows into property assignment operations without validating the property name against an allow-list. PHP permits dynamic attribute access using variable variables and array-driven property setters. When the property key is attacker-controlled, protected internal state can be overwritten, leading to object injection outcomes.
Attack Vector
The attack requires network access to the Drupal application and an authenticated session with elevated privileges. The attacker crafts a request that supplies both the property name and value to be assigned inside a vulnerable code path. No user interaction is required, and the attack complexity is high due to the specific conditions needed to reach the vulnerable sink. Refer to the Drupal Security Advisory for exploitation prerequisites.
Detection Methods for CVE-2026-55804
Indicators of Compromise
- Unexpected changes to Drupal configuration entities or user role assignments made by high-privilege accounts.
- Requests to administrative endpoints containing unusual parameter keys that map to internal object property names.
- Log entries showing serialized payloads or property-name arrays submitted through form or REST endpoints.
Detection Strategies
- Monitor Drupal watchdog and web server logs for POST or PATCH requests with unusually structured payloads targeting content, config, or entity endpoints.
- Alert on privilege escalation events where a non-administrative account gains permissions typically reserved for administrator roles.
- Compare running Drupal core version against the fixed releases listed in SA-CORE-2026-006 during routine vulnerability scans.
Monitoring Recommendations
- Enable verbose logging for authenticated administrative sessions and forward events to a centralized SIEM.
- Track changes to config tables and entity storage for modifications not tied to legitimate change tickets.
- Baseline normal parameter names accepted by Drupal endpoints and flag deviations for review.
How to Mitigate CVE-2026-55804
Immediate Actions Required
- Upgrade Drupal core to a patched release per SA-CORE-2026-006 on every production and staging site.
- Audit accounts holding high-privilege roles and remove access from users who no longer require it.
- Review recent administrative activity for anomalous configuration or entity modifications.
Patch Information
Drupal published fixes in the security advisory. Site operators must upgrade beyond 10.5.12, 10.6.11, 11.2.14, and 11.3.12, and away from unsupported 11.0.* and 11.1.* branches. Full details are available in the Drupal Security Advisory SA-CORE-2026-006.
Workarounds
- Restrict administrative and content-editing permissions to a minimal set of trusted users until patching completes.
- Place the Drupal admin path behind a web application firewall rule that limits access by source IP.
- Enforce multi-factor authentication on all accounts with elevated Drupal permissions to reduce credential-based exploitation risk.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
