An Object Injection issue exists in the Flag attendance field module due to the improper control of modification of dynamically-determined object attributes. The module stores data as PHP-serialized strings, and if malicious data is written directly to the field, it can lead to object injection during the unserialization process. This occurs when an attacker has permission to edit a content entity with an attached `flag attendance field` field and the core JSON:API module is enabled with the option to accept all create, read, update, and delete operations, or if the attacker has another method to edit field values directly.