---
id: "CVE-2026-114573"
kind: "vulnerability"
aliases: ["CVE-2026-114573"]
title: "Drupal Monster Menus: object injection flaw in versions up to 9.5.6"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "monster-menus", "package", "php"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-30T04:18:17+00:00"
first_seen_at: "2026-10-30T04:28:38+00:00"
updated_at: "2026-10-30T04:29:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114573", "first_seen_at": "2026-10-30T04:28:38+00:00"}]
---

# Drupal Monster Menus: object injection flaw in versions up to 9.5.6

Monster Menus, a Drupal module, has a flaw that lets an attacker manipulate object attributes through untrusted input, which is the object injection class of bug. The sources do not state what an attacker can reach beyond that.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Drupal site has the Monster Menus module installed and its version, for example with `drush pm:list --filter=monster_menus` (unknown whether this exact command applies to the project)
- Confirm whether the installed version falls within 0.0.0 to 9.5.6

## Fix

- Monster Menus: a fixed version is not stated in the sources; move past `9.5.6` once the vendor publishes it

## Timeline

- 2026-10-30T04:28:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114573

## From the sources

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Monster Menus allows Object Injection. This issue affects Monster Menus versions: from 0.0.0 to 9.5.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_