Home

Description

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affects ECA: Event - Condition - Action versions: from 0.0.0 to 2.1.20, from 3.0.0 to 3.0.12, from 3.1.0 to 3.1.4.

PUBLISHED Reserved 2026-07-08 | Published 2026-07-10 | Updated 2026-07-13 | Assigner drupal

Problem types

CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

Product status

0.0.0 (semver) before 2.1.20
affected

3.0.0 (semver) before 3.0.12
affected

3.1.0 (semver) before 3.1.4
affected

Credits

Changhai Qi (qichanghai) finder

Jürgen Haas (jurgenhaas) remediation developer

Neil Drumm (drumm) coordinator

Greg Knaddison (greggles) coordinator

Dave Long (longwave) coordinator

References

www.drupal.org/sa-contrib-2026-074

cve.org (CVE-2026-15083)

nvd.nist.gov (CVE-2026-15083)

Download JSON