CVE-2026-6366: Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.
This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6366?
CVE-2026-6366 has a medium severity rating of 6.6 based on the CVSS 3.1 scoring system.
How do I fix CVE-2026-6366?
To fix CVE-2026-6366, update your Drupal core to versions 10.5.9 or newer, 10.6.7 or newer, or 11.2.11 or newer as applicable.
What types of systems are affected by CVE-2026-6366?
CVE-2026-6366 affects Drupal core versions from 8.0.0 before 10.5.9, 10.6.0 before 10.6.7, 11.0.0 before 11.2.11, and 11.3.0 before 11.3.7.
What is the impact of CVE-2026-6366?
The impact of CVE-2026-6366 is the potential for Object Injection due to improperly controlled modification of dynamically-determined object attributes.
When was CVE-2026-6366 published?
CVE-2026-6366 was published on May 19, 2026.