{"id":"CVE-2026-114573","kind":"vulnerability","aliases":["CVE-2026-114573"],"related":[],"title":"Drupal Monster Menus: object injection flaw in versions up to 9.5.6","description":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Monster Menus allows Object Injection. This issue affects Monster Menus versions: from 0.0.0 to 9.5.6.","summary":"Monster Menus, a Drupal module, has a flaw that lets an attacker manipulate object attributes through untrusted input, which is the object injection class of bug. The sources do not state what an attacker can reach beyond that.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","monster-menus","package","php"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check whether the Drupal site has the Monster Menus module installed and its version, for example with `drush pm:list --filter=monster_menus` (unknown whether this exact command applies to the project)\n- Confirm whether the installed version falls within 0.0.0 to 9.5.6","fix":"- Monster Menus: a fixed version is not stated in the sources; move past `9.5.6` once the vendor publishes it","status":"open","published_at":"2026-10-30T04:18:17+00:00","first_seen_at":"2026-10-30T04:28:38+00:00","triaged_at":"2026-10-30T04:29:41+00:00","updated_at":"2026-10-30T04:29:41+00:00","category":"package","confidence":0.35,"triage":{"at":"2026-10-30T04:29:41Z","model":"claude-haiku-5-5","output":{"fix":"- Monster Menus: a fixed version is not stated in the sources; move past `9.5.6` once the vendor publishes it","reach":"unknown","title":"Drupal Monster Menus: object injection flaw in versions up to 9.5.6","impact":"high","summary":"Monster Menus, a Drupal module, has a flaw that lets an attacker manipulate object attributes through untrusted input, which is the object injection class of bug. The sources do not state what an attacker can reach beyond that.","audience":"developers","category":"package","nicknames":[],"who_cares":["drupal","monster-menus","php"],"confidence":0.35,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; object injection can enable code execution, not confirmed by sources","analyst_note":"Confirm the fixed version, required privileges and whether it is reachable unauthenticated; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-114573 and the Drupal security advisory.","how_to_check":"- Check whether the Drupal site has the Monster Menus module installed and its version, for example with `drush pm:list --filter=monster_menus` (unknown whether this exact command applies to the project)\n- Confirm whether the installed version falls within 0.0.0 to 9.5.6","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites running the Monster Menus module at a version listed as affected (0.0.0 through 9.5.6). The sources do not say which configurations or user roles are needed to reach the flaw.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00071,"input_tokens":4105,"output_tokens":599,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114573':14A,17A '-2026':13A,16A '0.0.0':85C '9.5.6':11A,87C 'affect':80C 'allow':75C 'attack':35B,57B 'attribut':38B,69C 'beyond':60B 'bug':49B 'class':47B 'control':62C 'cve':12A,15A 'determin':67C 'drupal':1A,18B,27B,72C 'dynam':66C 'dynamically-determin':65C 'flaw':6A,31B 'improp':61C 'inject':5A,46B,77C 'input':41B 'issu':79C 'let':33B 'manipul':36B 'menus':3A,21B,25B,74C,82C 'modif':63C 'modul':28B 'monster':2A,20B,24B,73C,81C 'monster-menus':19B 'object':4A,37B,45B,68C,76C 'packag':22B 'php':23B 'reach':59B 'sourc':51B 'state':54B 'untrust':40B 'version':8A,83C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites running the Monster Menus module at a version listed as affected (0.0.0 through 9.5.6). The sources do not say which configurations or user roles are needed to reach the flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T04:18:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114573","severity":null,"published_at":"2026-10-30T04:18:17+00:00","modified_at":"2026-10-30T04:18:17+00:00","first_seen_at":"2026-10-30T04:28:38+00:00","fetched_at":"2026-10-30T04:28:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}