CVE-2026-55809 - Flag attendance field - Critical - PHP object injection

Back Back to CVE browser

HIGH

Flag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049

Published Jul 10, 2026

8.1

HIGH

CVSS 3.1

EPSS 0.43%

Description

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issue affects Flag attendance field versions: from 0.0.0 to 1.2.

Affected products

Vendor Drupal Product Flag attendance field Default
unknown
Affected
- ≥ 0.0.0, < 1.2

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Drupal	Flag attendance field	unknown	Affected ≥ 0.0.0, < 1.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-915

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43053
Advisory
https://www.drupal.org/sa-contrib-2026-049
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43053		Advisory
https://www.drupal.org/sa-contrib-2026-049		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner drupal

Published Jul 10, 2026

Updated Jul 13, 2026

Reserved Jun 17, 2026

Link CVE-2026-55809

CISA Vulnrichment

Updated Jul 13, 2026

NVD

Status Analyzed

Modified Jul 14, 2026

Link CVE-2026-55809

Red Hat

No data

ENISA EUVD

Assigner drupal

Published Jul 10, 2026

Updated Jul 13, 2026

Link EUVD-2026-43053

GitHub

No data