Drupal Commerce Decoupled Checkout suffers from an Improperly Controlled Modification of Dynamically-Determined Object Attributes flaw that allows an attacker to perform object injection. By manipulating request parameters that are used to set properties on unspecified objects, a malicious actor can create or alter objects of types the system does not intend to expose, leading to potential unauthorized data manipulation or escalation of privileges. The weakness is coded as CWE-915 and could be exploited to compromise the integrity of e‑commerce transactions.

The vulnerability is present in Drupal Commerce Decoupled Checkout versions from 1.0.0 through 1.8.0. Systems using any of these releases should consider themselves exposed unless they have applied a fix beyond v1.8.0.

The CVSS score is 4.3, and the EPSS score is <1%, indicating a low probability of exploitation. Because the flaw allows injection of arbitrary objects, it is inferred that an attacker with network or authenticated access could move laterally within the system. The issue is not listed in CISA KEV, so there are no confirmed, publicly known exploits yet, but the absence of a patch in the affected versions makes it a high‑risk target for exploitation once discovered.