This vulnerability, classified as CWE-915, involves improperly controlled modification of dynamically-determined object attributes in the Drupal Flag attendance field module. This flaw enables object injection attacks, which can potentially allow an attacker to manipulate object properties in an unintended manner. The affected versions include 0.0.0 through 1.2 of the module. No CVSS score or vendor advisory is available to provide further technical or remediation details.

The vulnerability allows object injection via improper control of object attribute modification. This could lead to unauthorized manipulation of application behavior or data integrity within the affected Drupal module. However, no known exploits have been reported, and the exact impact depends on the context of use within Drupal installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Drupal security advisories for updates. Until a patch is available, consider restricting access to the affected module and reviewing usage to minimize exposure.