OpenCVE

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affects ECA: Event - Condition - Action versions: from 0.0.0 to 2.1.20, from 3.0.0 to 3.0.12, from 3.1.0 to 3.1.4.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Drupal	Eca:event - Condition - Action

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2026-074

History

Mon, 13 Jul 2026 19:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sat, 11 Jul 2026 01:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Drupal Drupal eca:event - Condition - Action
Vendors & Products		Drupal Drupal eca:event - Condition - Action

Fri, 10 Jul 2026 22:00:00 +0000

Type	Values Removed	Values Added
Description		Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affects ECA: Event - Condition - Action versions: from 0.0.0 to 2.1.20, from 3.0.0 to 3.0.12, from 3.1.0 to 3.1.4.
Title		ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074
Weaknesses		CWE-915
References		https://www.drupal.org/sa-contrib-2026-074

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2026-07-10T21:46:33.886Z

Updated: 2026-07-13T18:18:06.766Z

Reserved: 2026-07-08T15:44:57.178Z

Link: CVE-2026-15083

Vulnrichment

Updated: 2026-07-13T18:17:59.812Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15083", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2026-07-08T15:44:57.178Z", "datePublished": "2026-07-10T21:46:33.886Z", "dateUpdated": "2026-07-13T18:18:06.766Z"}, "containers": {"cna": {"title": "ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074", "datePublic": "2026-07-08T17:16:32.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-074"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-915", "description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes", "lang": "en", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-586", "descriptions": [{"lang": "en", "value": "CAPEC-586 Object Injection"}]}], "affected": [{"collectionURL": "https://www.drupal.org/project/eca", "product": "ECA: Event - Condition - Action", "vendor": "Drupal", "repo": "https://git.drupalcode.org/project/eca", "versions": [{"lessThan": "2.1.20", "status": "affected", "version": "0.0.0", "versionType": "semver"}, {"lessThan": "3.0.12", "status": "affected", "version": "3.0.0", "versionType": "semver"}, {"lessThan": "3.1.4", "status": "affected", "version": "3.1.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affects ECA: Event - Condition - Action versions: from 0.0.0 to 2.1.20, from 3.0.0 to 3.0.12, from 3.1.0 to 3.1.4."}], "credits": [{"lang": "en", "type": "finder", "value": "Changhai Qi (qichanghai)"}, {"lang": "en", "type": "remediation developer", "value": "J\u00c3\u00bcrgen Haas (jurgenhaas)"}, {"lang": "en", "type": "coordinator", "value": "Neil Drumm (drumm)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Dave Long (longwave)"}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-07-10T21:46:33.886Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-13T18:17:35.787782Z", "id": "CVE-2026-15083", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T18:18:06.766Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-15083", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-13T18:17:35.787782Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T18:17:59.812Z"}}], "cna": {"title": "ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074", "credits": [{"lang": "en", "type": "finder", "value": "Changhai Qi (qichanghai)"}, {"lang": "en", "type": "remediation developer", "value": "J\u00c3\u00bcrgen Haas (jurgenhaas)"}, {"lang": "en", "type": "coordinator", "value": "Neil Drumm (drumm)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Dave Long (longwave)"}], "impacts": [{"capecId": "CAPEC-586", "descriptions": [{"lang": "en", "value": "CAPEC-586 Object Injection"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/eca", "vendor": "Drupal", "product": "ECA: Event - Condition - Action", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "2.1.20", "versionType": "semver"}, {"status": "affected", "version": "3.0.0", "lessThan": "3.0.12", "versionType": "semver"}, {"status": "affected", "version": "3.1.0", "lessThan": "3.1.4", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/eca"}], "datePublic": "2026-07-08T17:16:32.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-074"}], "descriptions": [{"lang": "en", "value": "Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affects ECA: Event - Condition - Action versions: from 0.0.0 to 2.1.20, from 3.0.0 to 3.0.12, from 3.1.0 to 3.1.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-915", "description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-07-10T21:46:33.886Z"}}}, "cveMetadata": {"cveId": "CVE-2026-15083", "state": "PUBLISHED", "dateUpdated": "2026-07-13T18:18:06.766Z", "dateReserved": "2026-07-08T15:44:57.178Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2026-07-10T21:46:33.886Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}