A vulnerability in Drupal core allows Object Injection due to improperly controlled modification of dynamically-determined object attributes. This affects multiple Drupal core versions from 8.0.0 up to but not including 10.4.9, from 10.5.0 up to but not including 10.5.6, from 11.0.0 up to but not including 11.1.9, and from 11.2.0 up to but not including 11.2.8. The flaw has been addressed in the fixed versions 10.4.9, 10.5.6, 11.1.9, and 11.2.8. The CVSS v3.1 base score is 5.9, indicating a medium severity impact with high confidentiality and integrity impact but no availability impact. No known exploits are reported in the wild at this time.