The vulnerability identified as CVE-2026-15083 in the Drupal ECA: Event - Condition - Action module involves improper control over modification of dynamically-determined object attributes, classified under CWE-915. This flaw enables object injection attacks. Affected versions include 0.0.0 through 2.1.20, 3.0.0 through 3.0.12, and 3.1.0 through 3.1.4. The CVSS v3.1 base score is 4.2, reflecting a network attack vector with high attack complexity, requiring low privileges and no user interaction, resulting in low confidentiality and integrity impacts and no availability impact. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation could allow an attacker with low privileges to perform object injection, potentially leading to limited confidentiality and integrity impacts within affected Drupal ECA module instances. There is no reported impact on availability. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected module and monitor for unusual activity related to object attribute manipulation. Avoid deploying affected versions in sensitive environments if possible.