This vulnerability (CWE-915) in Drupal core allows an attacker with high privileges to improperly modify dynamically-determined object attributes, resulting in object injection. Affected versions include Drupal core from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, and from 11.3.0 before 11.3.7. The CVSS 3.1 base score is 6.6 with network attack vector, high attack complexity, requiring privileges, no user interaction, and impacts confidentiality, integrity, and availability. No vendor advisory or patch links are provided, and the remediation level is not specified.

Successful exploitation could lead to high impact on confidentiality, integrity, and availability of the affected Drupal installations. However, exploitation requires high privileges and has high attack complexity, reducing the likelihood of widespread exploitation. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the official Drupal vendor advisory for current remediation guidance. Until an official fix is released, restrict high privilege access and monitor for unusual activity related to object attribute modifications. Avoid applying unverified third-party patches.