CVE-2026-1774 | CASL Ability up to 6.7.4 Extra rulesToFields prototype pollution

A vulnerability classified as critical has been found in CASL Ability up to 6.7.4. The affected element is the function rulesToFields of the component Extra Module. The manipulation leads to improperly controlled modification of object prototype attributes.

This vulnerability is uniquely identified as CVE-2026-1774. The attack is possible to be carried out remotely. No exploit exists.

It is recommended to upgrade the affected component.