This vulnerability (CVE-2026-6366) in Drupal core is categorized under CWE-915, which relates to improperly controlled modification of dynamically-determined object attributes. This flaw allows an attacker with high privileges to perform object injection, potentially compromising the confidentiality, integrity, and availability of the affected system. The affected versions include Drupal core from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, and from 11.3.0 before 11.3.7. The CVSS 3.1 vector indicates network attack vector, high attack complexity, required privileges, no user interaction, and impacts all security properties highly. No patch or official remediation level is currently documented.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject objects, potentially leading to full compromise of confidentiality, integrity, and availability of the Drupal installation. Given the CVSS score of 6.6, the impact is considered medium but affects critical security properties. There are no known exploits in the wild, reducing immediate risk, but the vulnerability remains significant for affected versions.

Patch status is not yet confirmed — check the official Drupal vendor advisory for current remediation guidance. Until an official fix is released, restrict access to privileged accounts and monitor for suspicious activity related to object manipulation. Avoid upgrading to affected versions and consider applying any available security updates once published by Drupal.