CVE-2026-9726

Drupal AlternativeCommerce (Basket) versions 0.0.0 to 2.1.17 are vulnerable to an object injection flaw due to improperly controlled modifications of dynamically-determined object attributes. This critical vulnerability can lead to unauthorized access and manipulation of object data, potentially compromising the integrity of the application. Organizations using affected versions should prioritize immediate remediation to mitigate risks of exploitation.