The vulnerability identified as CVE-2026-55809 affects the Drupal Flag attendance field module, specifically versions from 0.0.0 to 1.2. It is classified under CWE-915, which involves improperly controlled modification of dynamically-determined object attributes. This flaw enables object injection, potentially allowing an attacker to manipulate object attributes in an unauthorized manner. The CVSS v3.1 base score is 8.1, indicating a high severity with network attack vector, low attack complexity, requiring low privileges and no user interaction, and resulting in high confidentiality and integrity impact. No official patch or remediation level has been provided yet, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an attacker with low privileges to inject or modify object attributes dynamically, leading to unauthorized access or manipulation of sensitive data (high confidentiality impact) and unauthorized modification of data or system state (high integrity impact). Availability is not impacted. This could compromise the integrity and confidentiality of the Drupal site using the affected Flag attendance field module.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Drupal's official security advisories for updates. Until a patch is available, consider restricting access to the affected module and applying any recommended temporary mitigations from Drupal if available.