CVE-2026-9726

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17.

Scoring

Severity

CRITICAL

CVSS base score

9.8

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS probability

0.56%

CWE

CWE-915

Published

2026-07-10

Last modified

2026-07-14

Affected products

• Drupal Drupal AlternativeCommerce (Basket)

Weakness type

• CWE-915

Related vulnerabilities

• CVE-2026-85408 — Eleveo Quality Management Conversation events dynamically-determined object attributes
• CVE-2026-84430 — gouguoa edit_personal Endpoint Index.php update dynamically-determined object attributes
• CVE-2026-83557 — jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types
• CVE-2026-78038 — Job argument injection via :args overrides primary_key and tenant in AshOban
• CVE-2026-77144 — Broken Access Control in extension "Events 2" (events2)
• CVE-2026-71504 — Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset
• CVE-2026-78416 — Authenticated RCE via `condition.config` JSON cleanse bypass
• CVE-2026-62315 — Frappe: Mass assignment via set_value

Markdown version · Browse all CVEs