CVE-2026-55804

Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

We have discovered 180,897 live websites that are affected by CVE-2026-55804.

Run a Free Instant Scan



Affected Software

Product  Drupal
Category Content Management System
Vulnerable Domains180,897 live websites (88% of Drupal install base)
Vulnerable Versions
  • from 0 through 10.5.12
  • from 10.6 through 10.6.11
  • from 11.2 through 11.2.14
  • from 11.3 through 11.3.12
Vulnerable Versions Count311 versions ( 91% of all versions)


Common Weakness Enumeration

CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes



Details

  • Published - Jul 10, 2026
  • Updated - Jul 13, 2026

Credits

  • Michael Maturi (michaelmaturi) (finder)
  • Lee Rowlands (larowlan) (remediation developer)
  • Drew Webber (mcdruid) (remediation developer)
  • Mohit Aghera (mohit_aghera) (remediation developer)
  • Anna Kalata (akalata) (coordinator)
  • Benji Fisher (benjifisher) (coordinator)
  • cilefen (cilefen) (coordinator)
  • Greg Knaddison (greggles) (coordinator)
  • Lee Rowlands (larowlan) (coordinator)
  • Dave Long (longwave) (coordinator)
  • Drew Webber (mcdruid) (coordinator)
  • Juraj Nemec (poker10) (coordinator)
  • Jess (xjm) (coordinator)

Website Distribution by Country

Number of websites using CVE-2026-55804
United States56,478 websites


Germany16,585 websites
France13,599 websites
Russia11,735 websites
Belgium7,368 websites
GB6,445 websites
Italy5,566 websites
Netherlands5,159 websites
Spain4,600 websites
Canada4,585 websites

Website Distribution by TLD

Number of websites using CVE-2026-55804
.com46,605 websites
.org16,863 websites
.de10,375 websites
.ru9,428 websites
.edu8,005 websites
.fr7,178 websites
.be6,877 websites
.nl4,423 websites
.it4,207 websites
.net3,884 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-55804

Top websites that are affected by CVE-2026-55804. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***.**.uk GB***
***.gov United States***
****.fr France***
***.gov United States***
***.gov United States*,***
*******.gov United States*,***
********.***.gov United States*,***
***.gov United States*,***
******.com United States*,***
***.*******.edu United States*,***
See full domain list

FAQ

CVE-2026-55804 is Improperly Controlled Modification of Dynamically-Determined Object Attributes in Drupal
A total of 180,897 websites have been identified as vulnerable to CVE-2026-55804, based on global website indexing conducted by WebTechSurvey.
The Drupal is affected by the CVE-2026-55804 vulnerability.
Drupal versions up to 11.3.12 are vulnerable to CVE-2026-55804.
CVE-2026-55804 is resolved in version 11.3.12 of Drupal.