Drupal AlternativeCommerce OI IMCA Obj Injection 0.0.02.1.17
CVE-2026-9726 Published on July 10, 2026
Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17.
Vulnerability Analysis
CVE-2026-9726 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Type
What is a Mass Assignment Vulnerability?
The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
CVE-2026-9726 has been classified to as a Mass Assignment vulnerability or weakness.
Products Associated with CVE-2026-9726
Want to know whenever a new CVE is published for Drupal? stack.watch will email you.
Affected Versions
Drupal AlternativeCommerce (Basket):- Version 0.0.0 and below 2.1.17 is affected.