PT-2026-50606 · Drupal · Drupal

Anna Kalata + 14 · CVE-2026-55803 · Published 2026-06-17 · Updated 2026-07-19

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Drupal core (affected versions not specified)

Description An attacker with appropriate JSON:API write permissions could potentially inject a malicious payload in certain rare circumstances, leading to PHP Object Injection. PHP Object Injection occurs when untrusted input is used to instantiate objects, which can allow an attacker to execute arbitrary code or manipulate application logic. This issue is exploitable only if a site uses an entity reference field type that stores a serialized property and has enabled write access for JSON:API, which is read-only by default.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-915

Related Identifiers

BIT-DRUPAL-2026-55803

CVE-2026-55803

DRUPAL-CORE-2026-005

Affected Products

Drupal

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55803.json · Exploit
• https://drupal.org/sa-core-2026-005 · Vendor Advisory
• https://osv.dev/vulnerability/DRUPAL-CORE-2026-005 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-drupal-2026-55803 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-55803 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-55803 · Security Note
• https://git.drupalcode.org/project/drupal · Note
• https://drupal.org/project/drupal · Note
• https://twitter.com/autumn_good_35/status/2067620212967633078 · Twitter Post
• https://t.me/cveNotify/195894 · Telegram Post