EUVD-2026-43072
GHSA-7v2j-q5j9-4g8x
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-accessible flaw requiring low-privilege authentication; missing authorization yields limited read/write bypass with no availability or scope impact.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
AnalysisAI
Missing Authorization (CWE-862) in the Drupal FlowDrop contributed module allows authenticated low-privilege users to perform Forceful Browsing - directly accessing protected URLs without proper permission checks being enforced. All FlowDrop releases from 0.0.0 up to 1.6.0 are affected; a successful attacker can read or modify content and workflow data beyond their authorized scope. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session on the Drupal site with at least low-level privileges (confirmed by PR:L in the CVSS vector) - unauthenticated visitors cannot exploit this vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 score of 5.4 (Medium) reflects a bounded but genuine impact: both confidentiality and integrity are rated Low (C:L/I:L), availability is unaffected (A:N), and scope is unchanged (S:U). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Drupal user holding a minimal low-privilege account constructs or discovers a FlowDrop-managed URL endpoint and navigates to it directly in their browser. Because the module omits the authorization check, the request succeeds and the attacker reads workflow data or modifies content they were not authorized to access. … |
| Remediation | Upgrade the FlowDrop Drupal contributed module to version 1.6.0 or later, which resolves the missing authorization issue per the vendor advisory at https://www.drupal.org/sa-contrib-2026-068. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today