Drupal FlowDrop CVE-2026-58590

Exploitation requires a valid authenticated session on the Drupal site with at least low-level privileges (confirmed by PR:L in the CVSS vector) - unauthenticated visitors cannot exploit this vulnerability. The attacker must be targeting a site with FlowDrop versions 0.0.0 through less than 1.6.0 installed and enabled. No special non-default configuration is indicated beyond the module being active. Exploitation is further bounded by: unchanged scope (S:U) meaning the attacker cannot pivot beyond the Drupal application itself; low confidentiality and integrity impact with no availability impact; and the need to identify or enumerate FlowDrop-managed URL paths. Sites that issue authenticated accounts only to trusted internal users, or that do not expose the Drupal front-end to untrusted networks, face significantly reduced practical risk.

The vendor-assigned CVSS 3.1 score of 5.4 (Medium) reflects a bounded but genuine impact: both confidentiality and integrity are rated Low (C:L/I:L), availability is unaffected (A:N), and scope is unchanged (S:U). The low-complexity, low-privilege network vector makes exploitation straightforward for any authenticated Drupal user on a site running a vulnerable FlowDrop version. However, EPSS at 0.18% (8th percentile) signals very low real-world exploitation activity, and the absence of a CISA KEV listing and public POC further reduces urgency. Realistic priority is moderate for community or membership Drupal sites where low-privileged accounts are broadly issued to untrusted users; sites where all authenticated accounts belong to trusted internal staff face substantially lower exposure. No data conflicts or signal contradictions were identified - CVSS, EPSS, and KEV status are mutually consistent with a low-exploitation-probability Medium severity finding.

An authenticated Drupal user holding a minimal low-privilege account constructs or discovers a FlowDrop-managed URL endpoint and navigates to it directly in their browser. Because the module omits the authorization check, the request succeeds and the attacker reads workflow data or modifies content they were not authorized to access. No exploit tooling or elevated technical skill is required beyond knowing or enumerating the target URL.