This vulnerability (CWE-915) in Drupal core allows improper modification of dynamically-determined object attributes, which can lead to object injection attacks. It affects a broad range of Drupal core versions, including from initial releases up to 10.5.12, 10.6.0 to 10.6.11, 11.2.0 to 11.2.14, and 11.3.0 to 11.3.12, as well as all versions up to 11.0.* and 11.1.*. The CVSS 3.1 base score is 5.9, indicating medium severity with network attack vector, high attack complexity, requiring high privileges, no user interaction, unchanged scope, and high confidentiality and integrity impacts but no availability impact. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Successful exploitation could allow an attacker with high privileges to modify object attributes improperly, potentially leading to object injection and compromise of confidentiality and integrity of the affected system. The attack complexity is high, and no availability impact is noted. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, monitor Drupal's official security advisories for updates. Until a patch is available, restrict high-privilege access to Drupal core and review configurations to limit exposure to this vulnerability.