The vulnerability identified as CVE-2026-55803 in Drupal core involves improper control of modification of dynamically-determined object attributes, enabling object injection attacks. Affected versions include multiple ranges from initial releases through versions 10.5.12, 10.6.11, 11.2.14, and 11.3.12, as well as all versions up to 11.0.* and 11.1.*. The vulnerability is associated with CWE-915 (Improper Control of Dynamically-Managed Object Attributes). The CVSS vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no availability impact. No patch or remediation details are provided in the available data, and no known exploits have been reported.

Successful exploitation could allow an attacker with high privileges to modify object attributes improperly, potentially leading to unauthorized disclosure or modification of sensitive information (high confidentiality and integrity impact). Availability is not affected. The attack requires network access and high privileges, with no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor Drupal's official security advisories for updates. Until a fix is available, restrict high-privilege access and review object attribute handling in custom code if applicable.