Loading vulnerability…
Missing Authorization in Drupal LocalGov Workflows
CVE-2026-10768 is a missing authorization vulnerability in Drupal LocalGov Workflows affecting versions 0.0.0 through 1.6.0. An unauthenticated remote attacker can use forceful browsing to access a content-by-owner administrative endpoint without the required authorization. Requests involving the service_contact_id parameter can disclose content that should be access-restricted.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can expose restricted content or information through unauthorized access to the content-by-owner functionality. The vulnerability is network-exploitable with low attack complexity and requires neither authentication nor user interaction. The exact scope of disclosed information is not established.
If you can’t patch tonight, do this now.
Until a fixed release is deployed, restrict access to the affected LocalGov Workflows administrative functionality using compensating controls such as web server or application-layer access restrictions, limiting exposure to trusted administrative users only. Monitor for suspicious direct requests to the affected content retrieval functionality, and where feasible disable or isolate the vulnerable module functionality if it is not operationally required.
Patch, then assume compromise.
Upgrade Drupal LocalGov Workflows to a vendor-confirmed fixed release newer than 1.6.0 once available, following testing. An exact fixed version is not specified.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.