Drupal FlowDrop CVE-2026-58589

Exploitation requires a valid authenticated session with at least a low-privilege Drupal user account on a site running FlowDrop version prior to 1.6.0 (PR:L from CVSS vector). The Drupal installation must have the FlowDrop module enabled and installed; Drupal core sites without this specific contributed module are not affected. Exploitation is network-accessible with no user interaction required (AV:N, UI:N). Limiting factors include: the requirement for at least one authenticated account (blocking anonymous or unauthenticated access to the site entirely prevents exploitation); the scope of impact is limited to the module's own data and actions (S:U, no scope change to the broader Drupal instance); and the vulnerability does not affect availability. Sites that restrict account registration to trusted users are at materially lower risk.

The CVSS 3.1 score of 5.4 (Medium) reflects a network-reachable, low-complexity flaw requiring only a low-privilege authenticated session (PR:L), with limited confidentiality and integrity impact (C:L/I:L) and no availability impact. The EPSS score of 0.18% at the 8th percentile strongly indicates this vulnerability is not being actively scanned for or exploited in the wild, consistent with the absence of a CISA KEV entry and no reported POC. The real-world risk profile is therefore moderate: on Drupal sites with FlowDrop installed where untrusted authenticated users exist (e.g., community sites, subscription portals), the missing authorization check could allow privilege escalation within the module's functional scope. For sites where all authenticated users are trusted staff, practical risk is low. No conflicting signals between CVSS and EPSS were identified - both consistently suggest limited real-world exploitation activity.

An attacker with a low-privilege Drupal account (e.g., a registered community member or trial user) constructs a direct HTTP GET or POST request to a FlowDrop-managed URL that is intended to be restricted to administrators or elevated roles. Because the module does not perform the expected authorization check, the Drupal framework returns the resource or executes the action without rejecting the request, granting access to content or functionality beyond the attacker's assigned permissions. No publicly available proof-of-concept code has been identified, but the low attack complexity means this technique is easily reproducible from Drupal's routing documentation alone.