CVE-2026-55809 Overview
CVE-2026-55809 is an object injection vulnerability in the Drupal Flag attendance field contributed module. The flaw stems from improperly controlled modification of dynamically-determined object attributes [CWE-915] during deserialization of untrusted input. Affected versions include Flag attendance field 0.0.0 through 1.2. An authenticated attacker with low privileges can send crafted input over the network to manipulate object attributes and trigger unsafe deserialization behavior. The Drupal Security Team published advisory SA-CONTRIB-2026-049 describing the issue and the fixed release.
Critical Impact
A network-reachable attacker holding low-privilege credentials can inject attacker-controlled object attributes, resulting in high impact to confidentiality and integrity of the Drupal site.
Affected Products
- Drupal Flag attendance field module versions 0.0.0 through 1.2
- Drupal sites installing the flag_attendance_field contributed project
- Any Drupal deployment exposing endpoints that process Flag attendance field input
Discovery Timeline
- 2026-07-10 - CVE-2026-55809 published to NVD
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2026-55809
Vulnerability Analysis
The Flag attendance field module extends Drupal's Flag framework to record attendance state on entities. The vulnerable code path accepts input that influences which object attributes get set during processing, without validating the target class or property list. Because Drupal relies on PHP object handling, uncontrolled attribute assignment enables PHP Object Injection.
An attacker submits crafted serialized input to a request handler exposed by the module. The module then reconstructs or mutates an object using attacker-controlled keys and values. When that object interacts with existing gadget chains in Drupal core or other contributed modules, the manipulation escalates from data tampering to attacker-influenced application logic. The CVSS vector shows network reach with low complexity and low privileges required, and no user interaction is needed.
Root Cause
The root cause is a failure to constrain which object attributes may be modified based on external input, classified under [CWE-915]. The module treats input keys as trusted property names and applies them to internal objects. Without an allowlist or type check, an attacker overrides sensitive attributes such as callback references, file paths, or state flags.
Attack Vector
Exploitation requires network access and an authenticated account with permission to interact with Flag attendance field entities. The attacker submits a POST or form request containing crafted attribute data. The server-side handler assigns the attacker-supplied values to a live object, and downstream logic acts on the corrupted state. No public proof-of-concept, exploit code, or CISA KEV listing exists for this issue at time of writing.
Refer to the Drupal Security Advisory SA-CONTRIB-2026-049 for module-specific technical details.
Detection Methods for CVE-2026-55809
Indicators of Compromise
- Unexpected POST requests to Flag attendance field routes containing serialized PHP payloads or unusual attribute keys.
- New or modified files under the Drupal sites/default/files directory that correlate with authenticated sessions using low-privileged roles.
- PHP error log entries referencing __wakeup, __destruct, or unserialize warnings tied to the flag_attendance_field module.
- Outbound network connections initiated by the web server process following requests to attendance endpoints.
Detection Strategies
- Inspect Drupal watchdog logs for anomalous entity operations on flag attendance entities by non-administrative users.
- Deploy web application firewall rules that flag serialized PHP patterns such as O: and a: in request bodies to module endpoints.
- Correlate authenticated user actions with process-level telemetry on the web host to catch script or shell spawns from php-fpm.
Monitoring Recommendations
- Enable verbose logging on the Drupal Flag subsystem and forward logs to a centralized analytics platform for retention.
- Alert on new PHP files written by the web server user account outside of scheduled deployments.
- Track version drift of contributed modules and generate an alert when a Drupal site runs flag_attendance_field at version 1.2 or earlier.
How to Mitigate CVE-2026-55809
Immediate Actions Required
- Upgrade the Flag attendance field module to the fixed release identified in Drupal Security Advisory SA-CONTRIB-2026-049.
- Audit user accounts that hold permissions to submit or edit flag attendance entities and revoke unnecessary access.
- Review web server and Drupal watchdog logs for requests to module endpoints since the module was installed.
Patch Information
The Drupal Security Team released a fixed version of the flag_attendance_field module addressing versions 0.0.0 through 1.2. Site operators should apply the update using composer update drupal/flag_attendance_field followed by drush updatedb and cache rebuild. Consult the vendor advisory for the exact fixed version string.
Workarounds
- Disable the Flag attendance field module using drush pm:uninstall flag_attendance_field until the patched release is deployed.
- Restrict the roles and permissions that can interact with flag attendance entities to trusted administrators only.
- Place the affected site behind a web application firewall configured to block PHP serialized payloads in request bodies.
# Configuration example: patch and verify the Flag attendance field module
composer update drupal/flag_attendance_field --with-dependencies
drush updatedb -y
drush cache:rebuild
drush pm:list --status=enabled | grep flag_attendance_field
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
