PT-2026-46112 · Drupal+2 · Localgov Workflows+1

Dave Long + 5 · CVE-2026-10768 · Published 2026-06-03 · Updated 2026-07-10

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LocalGov Workflows versions 0.0.0 through 1.6.0

Description Missing authorization allows forceful browsing within the module, which configures default editorial workflows for content types, including content moderation, approvals dashboards, scheduling, and previews. The issue stems from insufficient access restrictions to a view of Service Contacts, which exposes the names and content items assigned to each Service Contact.

Recommendations Update LocalGov Workflows to a version later than 1.6.0.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-10768

DRUPAL-CONTRIB-2026-039

Affected Products

Localgov Workflows

Drupal/Localgov Workflows

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10768.json · Exploit
• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-039 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-10768 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-10768 · Security Note
• https://git.drupalcode.org/project/localgov_workflows · Note
• https://t.me/cveNotify/195855 · Telegram Post
• https://drupal.org/project/localgov_workflows · Note
• https://drupal.org/sa-contrib-2026-039 · Note