CVE-2026-96378: CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes in Drupal Commerce Decoupled Checkout

This vulnerability, classified as CWE-915, involves improperly controlled modification of dynamically-determined object attributes in the Drupal Commerce Decoupled Checkout module. This flaw allows object injection attacks, which could lead to unintended behavior or security issues within affected versions 1.0.0 through 1.7.x. The vulnerability is publicly known but lacks detailed CVSS scoring and no official patch or remediation guidance is provided in the available data.

The vulnerability enables object injection due to improper control of object attribute modification. This could potentially allow attackers to manipulate application behavior or data structures in affected Drupal Commerce Decoupled Checkout versions. However, no known exploits in the wild have been reported, and the exact impact depends on the context of use within the application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor Drupal security advisories for updates and consider restricting access to the affected module or applying temporary mitigations if recommended by Drupal.