EUVD-2026-43071
GHSA-wfpx-3cw4-cw3g
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-accessible missing authorization flaw requiring a low-privilege authenticated session; C:L/I:L reflects partial access to restricted module data and actions with no availability or scope impact.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
4DescriptionCVE.org
Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
AnalysisAI
Missing authorization in the FlowDrop Drupal contributed module (versions prior to 1.6.0) enables authenticated low-privilege users to perform forceful browsing, accessing URLs and resources that should be restricted to higher-privilege roles. The vulnerability stems from CWE-862, where authorization checks are absent or bypassed on protected endpoints within the module. No public exploit code or CISA KEV listing exists at time of analysis; the EPSS score of 0.18% (8th percentile) reflects low observed exploitation probability, but the low attack complexity and network accessibility make it a meaningful risk on multi-tenant or public Drupal sites with the module installed.
Technical ContextAI
FlowDrop is a contributed module for the Drupal CMS, identified by CPE cpe:2.3:a:drupal:flowdrop:*:*:*:*:*:*:*:*. Drupal's access control architecture relies on hook-based permission checks and route access callbacks; CWE-862 (Missing Authorization) indicates that one or more routes or controller actions in FlowDrop fail to invoke or correctly enforce Drupal's access checking layer. The OWASP-defined attack pattern of Forceful Browsing means an attacker constructs direct HTTP requests to paths that should be gated by role or permission checks, circumventing the intended access control without exploiting any memory corruption or injection flaw. The attack complexity is low (AC:L) because no race condition or special environmental state is required - the missing check is consistently absent.
RemediationAI
Update the FlowDrop Drupal module to version 1.6.0 or later, as documented in the Drupal Security Advisory at https://www.drupal.org/sa-contrib-2026-067. Site administrators should apply this update via Composer or Drush (e.g., composer update drupal/flowdrop) and clear the Drupal cache after updating. If an immediate update is not feasible, a compensating control is to disable the FlowDrop module entirely until patching is possible - this removes the vulnerable routes from Drupal's routing system at the cost of losing the module's functionality. Restricting site access to trusted authenticated users only (by removing public or anonymous registration and auditing existing low-privilege accounts) reduces exposure but does not eliminate the vulnerability. Blocking specific affected routes at the web server or reverse proxy layer is also viable if the exact vulnerable paths are identified from the module's routing configuration.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today