What is the CVSS score of CVE-2026-10768?

CVE-2026-10768 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of LocalGov Workflows are affected by CVE-2026-10768?

The Drupal LocalGov Workflows contrib module (versions prior to 1.6.0) contains an authorization bypass permitting unauthenticated remote access to protected workflow routes, exposing sensitive…. A patch is available.

Is there a public PoC exploit available for CVE-2026-10768?

Yes, a public proof-of-concept exploit is available for CVE-2026-10768. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-10768?

Within 24 hours, audit all Drupal instances to identify deployment of the LocalGov Workflows contrib module and inventory installed versions. Within 7 days, upgrade all affected installations to version 1.6.0 or later, prioritizing production environments hosting editorial workflows. Within 30 days, verify patch compliance across all Drupal environments and implement version monitoring to prevent reversion to vulnerable versions.

LocalGov Workflows CVE-2026-10768

EUVD-2026-43114 CRITICAL

Missing Authorization (CWE-862)

2026-07-10 drupal

GHSA-m5cq-wg24-c9f2

Authentication Bypass Drupal Localgov Workflows

9.8

CVSS 3.1 · Vendor: drupal

Severity by source

Vendor (drupal) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

Unauthenticated network forceful browsing (AV:N/AC:L/PR:N/UI:N) exposing/altering workflow content gives C:H/I:H, but a missing-access-check bypass does not plausibly cause full availability loss, so A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (drupal).

CVSS VectorVendor: drupal

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 17:30 vuln.today

CVSS changed

Jul 14, 2026 - 15:22 NVD

9.8 (CRITICAL)

Patch available

Jul 10, 2026 - 23:02 EUVD

CVE Published

Jul 10, 2026 - 21:41 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 10, 2026 - 21:41 cve.org

CRITICAL 9.8

DescriptionCVE.org

Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0.

AnalysisAI

Missing authorization in the Drupal LocalGov Workflows contrib module (all versions 0.0.0 through 1.6.0, fixed in 1.6.0) lets remote attackers reach protected workflow-related routes through forceful browsing without proper permission checks. The flaw carries a vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N), but EPSS is low (0.14%, 4th percentile) and there is no public exploit identified at time of analysis. Affected sites are Drupal deployments running this LocalGov Drupal editorial-workflow module.

Technical ContextAI

LocalGov Workflows is a contributed Drupal module in the LocalGov Drupal distribution, which is built for UK local-government (council) websites and provides editorial content-moderation and workflow-state management. The root cause is CWE-862 (Missing Authorization): one or more routes/endpoints fail to enforce a permission or access check before serving a resource or performing a workflow action, so a user can reach them simply by requesting the URL directly ("forceful browsing"). Because Drupal's access system relies on per-route permission definitions and access callbacks, an omitted or misconfigured access check on a controller/route is the typical mechanism behind this class of bug. The affected CPE is cpe:2.3:a:drupal:localgov_workflows:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade the LocalGov Workflows module to version 1.6.0, which the vendor advisory identifies as the fixed release (Vendor-released patch: 1.6.0; per Drupal SA-CONTRIB-2026-039, https://www.drupal.org/sa-contrib-2026-039), then clear Drupal caches and rebuild the router so corrected access checks take effect. If you cannot immediately update, compensating controls include restricting access to the affected workflow/moderation routes at the reverse-proxy or web-server layer (for example, limiting the relevant module paths to authenticated editorial IP ranges), and reviewing Drupal role/permission assignments and content-moderation state-transition permissions to reduce what an unauthorized request could reach - noting these controls may block legitimate editors if paths are not scoped carefully and are only a stopgap. Confirm exact fixed-version details and any additional module dependencies against the linked advisory before deploying.