EUVD-2026-43072
GHSA-7v2j-q5j9-4g8x
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-accessible flaw requiring low-privilege authentication; missing authorization yields limited read/write bypass with no availability or scope impact.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
4DescriptionCVE.org
Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
AnalysisAI
Missing Authorization (CWE-862) in the Drupal FlowDrop contributed module allows authenticated low-privilege users to perform Forceful Browsing - directly accessing protected URLs without proper permission checks being enforced. All FlowDrop releases from 0.0.0 up to 1.6.0 are affected; a successful attacker can read or modify content and workflow data beyond their authorized scope. No public exploit has been identified and EPSS sits at 0.18% (8th percentile), indicating negligible observed exploitation probability at time of analysis; the vulnerability is not listed in CISA KEV.
Technical ContextAI
FlowDrop is a contributed module for the Drupal CMS (CPE: cpe:2.3:a:drupal:flowdrop) that provides workflow or data-flow functionality within Drupal installations. The root cause is CWE-862 (Missing Authorization): the module fails to verify whether the requesting principal holds sufficient Drupal permissions before granting access to specific routes or resources, enabling Forceful Browsing - a technique where an attacker directly navigates to a URL that should be protected but is not guarded by an access check. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U confirms the flaw is network-reachable at low attack complexity, requiring only a low-privilege authenticated session and no user interaction, with scope confined to the vulnerable Drupal application.
RemediationAI
Upgrade the FlowDrop Drupal contributed module to version 1.6.0 or later, which resolves the missing authorization issue per the vendor advisory at https://www.drupal.org/sa-contrib-2026-068. The patch is confirmed available from the vendor; the exact patched version boundary (1.6.0) is inferred from the affected-version ceiling in EUVD-2026-43072 and should be verified in the advisory before deployment. If an immediate upgrade is not feasible, temporarily disabling the FlowDrop module eliminates exposure but removes all associated workflow functionality - assess the operational impact before doing so. As a partial workaround, Drupal administrators can attempt to restrict low-privilege roles from accessing FlowDrop-managed routes via Drupal's permission and role configuration, though the specific routes requiring protection are not enumerated in available data, making completeness of this mitigation uncertain. Review the advisory for any module-specific configuration guidance.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today