Content Moderation Notifications
Monthly
Privilege escalation in Drupal's Content Moderation Notifications module (all versions before 3.9.0) stems from unsafe privilege definitions (CWE-267) embedded in the module's moderation workflow handling. An already-highly-privileged Drupal user can exploit improperly scoped permissions granted by the module to perform actions or access content beyond their intended role boundary within Drupal's RBAC model. No active exploitation (CISA KEV) or public proof-of-concept has been identified; a vendor patch at version 3.9.0 is available per Drupal security advisory SA-CONTRIB-2026-107.
Privilege escalation in Drupal's Content Moderation Notifications module (all versions before 3.9.0) stems from unsafe privilege definitions (CWE-267) embedded in the module's moderation workflow handling. An already-highly-privileged Drupal user can exploit improperly scoped permissions granted by the module to perform actions or access content beyond their intended role boundary within Drupal's RBAC model. No active exploitation (CISA KEV) or public proof-of-concept has been identified; a vendor patch at version 3.9.0 is available per Drupal security advisory SA-CONTRIB-2026-107.