Description
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affects ECA: Event - Condition - Action versions: from 0.0.0 to 2.1.20, from 3.0.0 to 3.0.12, from 3.1.0 to 3.1.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Drupal | ECA: Event - Condition - Action | 0.0.0 – < 2.1.20, 3.0.0 – < 3.0.12, 3.1.0 – < 3.1.4 | 2.1.20 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | drupal/eca | < 2.1.20 · >= 3.0.0, < 3.0.12 · >= 3.1.0, < 3.1.4 | 2.1.20, 3.0.12, 3.1.4 | DRUPAL-CONTRIB-2026-074 |
Advisories 1
- WID-SEC-2026-2251 Drupal Module: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 22, 2026