View online: https://www.drupal.org/sa-core-2026-005 Project: Drupal core [1] Date: 2026-June-05 Security risk: *Critical* 18 ∕ 25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: PHP object injection Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 ||
=11.3.0 <11.3.12 || >=11.4.0 <11.4.0-rc2 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55803 Description: SA-CORE-2019-003 [3] added protection for fields that store serialized data to disallow direct writes via web services.
The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentially inject a malicious payload in certain rare circumstances, potentially resulting in PHP Object Injection. This vulnerability is mitigated by the fact that in order to be exploitable: * A site must use an entity reference field type that stores a serialized property. * An attacker must have permission to write to the entity via JSON:API. No field type shipped with Drupal core meets these criteria, and contributed or user-created field types that do appear to be extremely unusual. This update protects all such fields; no changes are required in contributed modules. JSON:API is read-only by default, so sites are only affected if they have enabled write access (either through administrator configuration or the installation of a contributed or custom module that enables write access). .. DrupalSteward protection: This issue is being protected by Drupal Steward [4]. In this instance, we believe that the WAF rule will provide mitigation for the common/obvious vulnerability paths, but may not be able to cover all cases or work for all hosting providers. Additionally, several other core security advisories released today are /not/ mitigated by Drupal Steward. Therefore, our recommended action is still to plan an actual Drupal update within 24 hours of this release. Solution: Install the latest version: *Drupal 11* * If you use Drupal 11.3.x, update to Drupal 11.3.12 [5]. * If you use Drupal 11.2.x, update to Drupal 11.2.14 [6]. *Drupal 10* * If you use Drupal 10.6.x, update to Drupal 10.6.11 [7]. * If you use Drupal 10.5.x, update to Drupal 10.5.12 [8]. Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 [9] and Drupal 9 [10] have both reached end-of-life.) Reported By: * Michael Maturi (michaelmaturi) [11] Fixed By: * Björn Brala (bbrala) [12] * Sascha Grossenbacher (berdir) [13] * Lee Rowlands (larowlan) [14] of the Drupal Security Team * Dave Long (longwave) [15] of the Drupal Security Team * Drew Webber (mcdruid) [16] of the Drupal Security Team Coordinated By: * Anna Kalata (akalata) [17] of the Drupal Security Team * Benji Fisher (benjifisher) [18] of the Drupal Security Team * Damien McKenna (damienmckenna) [19] of the Drupal Security Team * David Strauss (david strauss) [20] of the Drupal Security Team * Neil Drumm (drumm) [21] of the Drupal Security Team * Greg Knaddison (greggles) [22] of the Drupal Security Team * Tim Hestenes Lehnen (hestenet) [23] * Lee Rowlands (larowlan) [24] of the Drupal Security Team * Dave Long (longwave) [25] of the Drupal Security Team * Drew Webber (mcdruid) [26] of the Drupal Security Team * Juraj Nemec (poker10) [27] of the Drupal Security Team * Ra Mänd (ram4nd) [28] provisional member of the Drupal Security Team * Jess (xjm) [29] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185158-drupal-security/-/work_items/1 [30] ------------------------------------------------------------------------------ Contribution record [31] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-core-2019-003 [4] https://www.drupal.org/steward [5] https://www.drupal.org/project/drupal/releases/11.3.12 [6] https://www.drupal.org/project/drupal/releases/11.2.14 [7] https://www.drupal.org/project/drupal/releases/10.6.11 [8] https://www.drupal.org/project/drupal/releases/10.5.12 [9] https://www.drupal.org/psa-2021-06-29 [10] https://www.drupal.org/psa-2023-11-01 [11] https://www.drupal.org/u/michaelmaturi [12] https://www.drupal.org/u/bbrala [13] https://www.drupal.org/u/berdir [14] https://www.drupal.org/u/larowlan [15] https://www.drupal.org/u/longwave [16] https://www.drupal.org/u/mcdruid [17] https://www.drupal.org/u/akalata [18] https://www.drupal.org/u/benjifisher [19] https://www.drupal.org/u/damienmckenna [20] https://www.drupal.org/u/david-strauss [21] https://www.drupal.org/u/drumm [22] https://www.drupal.org/u/greggles [23] https://www.drupal.org/u/hestenet [24] https://www.drupal.org/u/larowlan [25] https://www.drupal.org/u/longwave [26] https://www.drupal.org/u/mcdruid [27] https://www.drupal.org/u/poker10 [28] https://www.drupal.org/u/ram4nd [29] https://www.drupal.org/u/xjm [30] https://git.drupalcode.org/security/185158-drupal-security/-/work_items/1 [31] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....