EUVD-2026-43114
GHSA-m5cq-wg24-c9f2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Drupal site running LocalGov Workflows
-
ExploitRequest protected workflow route directly
-
ExecutionBypass missing authorization check
-
ImpactAccess or alter workflow-controlled content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The prerequisite is that the target Drupal site has the LocalGov Workflows module installed and enabled at a version below 1.6.0 (0.0.0-1.6.0), and that the vulnerable route(s) are reachable over the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, elevated privileges, or user interaction is required to reach the missing-authorization route. The primary limiting factor is deployment scope: only sites running this specific LocalGov Drupal contrib module are affected, which is a small, sector-specific population (UK local-government websites); the precise vulnerable path and the exact resource/action exposed are not detailed in the available data and should be confirmed against Drupal SA-CONTRIB-2026-039. |
| Impact | The signals here conflict and should be reconciled before treating this as an emergency. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) implies unauthenticated network exploitation with full confidentiality, integrity, and availability impact, yet the vulnerability class is Missing Authorization enabling Forceful Browsing, which usually yields unauthorized read/modify of specific content or workflow state rather than full system compromise or availability loss - the A:H (and possibly the blanket C:H/I:H) rating appears inflated for a forceful-browsing authorization bypass and should be verified against the Drupal advisory (SA-CONTRIB-2026-039). Countervailing signals lower the real-world urgency: EPSS is only 0.14% (4th percentile), the module is niche (UK local-government Drupal sites), there is no CISA KEV listing, and no public exploit or POC is identified. No SSVC decision data was provided in the input. Net: a genuine unauthenticated authorization bypass worth patching promptly on affected sites, but not a mass-exploited, high-probability internet-wide threat - priority should be scoped to organizations actually running LocalGov Workflows. |
| Exploit ScenarioDerived | An unauthenticated remote user, without any special role, directly requests a LocalGov Workflows route that lacks a proper access check (forceful browsing) and thereby views or triggers a workflow/moderation action they should not be permitted to perform. Given AV:N/AC:L/PR:N/UI:N the request needs no authentication, complexity, or user interaction, though no public POC or exploit code is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Missing authorization in the Drupal LocalGov Workflows contrib module (all versions 0.0.0 through 1.6.0, fixed in 1.6.0) lets remote attackers reach protected workflow-related routes through forceful browsing without proper permission checks. The flaw carries a vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N), but EPSS is low (0.14%, 4th percentile) and there is no public exploit identified at time of analysis. Affected sites are Drupal deployments running this LocalGov Drupal editorial-workflow module.
RemediationAI
Upgrade the LocalGov Workflows module to version 1.6.0, which the vendor advisory identifies as the fixed release (Vendor-released patch: 1.6.0; per Drupal SA-CONTRIB-2026-039, https://www.drupal.org/sa-contrib-2026-039), then clear Drupal caches and rebuild the router so corrected access checks take effect. If you cannot immediately update, compensating controls include restricting access to the affected workflow/moderation routes at the reverse-proxy or web-server layer (for example, limiting the relevant module paths to authenticated editorial IP ranges), and reviewing Drupal role/permission assignments and content-moderation state-transition permissions to reduce what an unauthorized request could reach - noting these controls may block legitimate editors if paths are not scoped carefully and are only a stopgap. Confirm exact fixed-version details and any additional module dependencies against the linked advisory before deploying.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LocalGov Workflows is a contributed Drupal module in the LocalGov Drupal distribution, which is built for UK local-government (council) websites and provides editorial content-moderation and workflow-state management. The root cause is CWE-862 (Missing Authorization): one or more routes/endpoints fail to enforce a permission or access check before serving a resource or performing a workflow action, so a user can reach them simply by requesting the URL directly ("forceful browsing"). Because Drupal's access system relies on per-route permission definitions and access callbacks, an omitted or misconfigured access check on a controller/route is the typical mechanism behind this class of bug. The affected CPE is cpe:2.3:a:drupal:localgov_workflows:*:*:*:*:*:*:*:*.
Know when Localgov Workflows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network forceful browsing (AV:N/AC:L/PR:N/UI:N) exposing/altering workflow content gives C:H/I:H, but a missing-access-check bypass does not plausibly cause full availability loss, so A:N.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
4DescriptionCVE.org
Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0.
Executive ViewAI
The Drupal LocalGov Workflows contrib module (versions prior to 1.6.0) contains an authorization bypass permitting unauthenticated remote access to protected workflow routes, exposing sensitive editorial processes and content management pipelines. Organizations deploying this module risk unauthorized viewing or manipulation of editorial workflows and potential data exposure of workflow metadata. Patching to version 1.6.0 is required to restore access controls.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB