Content Moderation Notifications EUVD-2026-70004

The attacker must already hold a high-privileged Drupal account (PR:H per CVSS vector), restricting the threat to trusted-but-over-privileged internal users rather than external unauthenticated actors. High attack complexity (AC:H) indicates that a specific content moderation workflow state or transition condition must be present for exploitation. The Content Moderation Notifications module must be installed and active on the target Drupal site. No special network position or user interaction from a victim is required (AV:N, UI:N). Impact is bounded to low confidentiality and low integrity exposure - no availability impact is present, and scope does not extend beyond the vulnerable system.

The provided CVSS 3.3 (Low) score accurately reflects real-world exploitation difficulty: PR:H means the attacker must already hold a high-privileged Drupal account, and AC:H indicates a specific triggering condition (likely a particular workflow state transition) must be met. The unchanged scope (S:U) and constrained impact (C:L/I:L/A:N) further cap potential damage to minor information access or limited integrity modification. No EPSS data was supplied in the input, no CISA KEV listing exists, and no public exploit is identified - all consistent with a low-priority finding. Real-world risk is primarily relevant to sites that grant high Drupal roles to partially-trusted users; sites with strict role hygiene are minimally exposed.

An authenticated Drupal user already holding a high-privileged editorial role (such as a content reviewer or moderator) triggers a specific content moderation workflow transition handled by the module's notification logic. The unsafe privilege definition allows this action to grant the user capabilities or content access beyond what their role should permit under Drupal's standard RBAC model. No public proof-of-concept exploit exists at time of analysis, and the AC:H requirement limits opportunistic exploitation.