CVE-2026-58589
FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-067
Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-067
Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
- Record
CVE-2026-58589- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2026-43071
Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
- Record
EUVD-2026-43071- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wfpx-3cw4-cw3g
Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue...
Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
- Record
GHSA-wfpx-3cw4-cw3g- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
NVD
Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
- Record
CVE-2026-58589- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSV
FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-067
Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
- Record
CVE-2026-58589- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVDRUPAL-CONTRIB-2026-067 No score
This module enables you to test and run AI-driven workflows interactively through a chat interface.
The module doesn't sufficiently enforce permissions on certain endpoints. Attackers may be able to trigger workflow execution (incurring LLM spend and tool side effects) or send messages into other user's sessions.
This vulnerability is mitigated by the fact that an attacker must have the permission "View any session", which is not granted to anonymous or authenticated users by default.
- Record
DRUPAL-CONTRIB-2026-067- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/flowdropPackagist:https://packages.drupal.org/8 |
before 1.6.0 | 1.6.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-58589 is a medium vulnerability (CVSS 5.4) in Drupal Flowdrop, published July 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. Fixed in drupal/flowdrop 1.6.0.