External risk intelligence

Drupal LocalGov Workflows Forceful Browsing Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-10768

This vulnerability affects Drupal, a content management system. Drupal sites are commonly deployed as public-facing web applications, making this interface inherently reachable from the internet in typical deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A missing authorization vulnerability in the Drupal LocalGov Workflows module allows unauthorized access to restricted content or functionality. This issue affects specific versions of the module and could be exploited by unauthenticated attackers to gain access to sensitive information or perform unauthorized actions. The primary concern is confirming if your organization utilizes this module and is therefore exposed.

Unauthenticated access to restricted content.
Critical security risk for Drupal LocalGov Workflows.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to a Drupal site running the LocalGov Workflows module. Because the module fails to properly check user permissions, an unauthenticated attacker could gain access to restricted administrative functions, potentially leading to full control over the affected website.

No authentication required for access.
Navigating to specific, unauthorized endpoints.
Complete site compromise is possible.

Live Threat

Current exploitation, exposure, and threat context

A missing authorization vulnerability in Drupal LocalGov Workflows could allow an unauthenticated attacker to access unauthorized content or perform unintended actions on the system. This could occur when the workflow module's authorization checks are bypassed, potentially exposing sensitive information or disrupting service behavior.

System data could be exposed.
Forceful browsing via network access.
Unauthorized content access possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Drupal LocalGov Workflows could allow unauthorized access to sensitive data and functionality. System owners, in coordination with their Drupal application administrators and infrastructure teams, should first identify all instances of LocalGov Workflows within their environment. Subsequently, confirm the business criticality and external reachability of these instances to prioritize remediation efforts and engage the appropriate teams for planning.

App owners should drive issue resolution.
Verify LocalGov Workflows exposure and criticality.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the LocalGov Workflows module in Drupal?

LocalGov Workflows is an extension for the Drupal content management system designed to help local government organizations manage editorial processes and content publication cycles. It provides tools for teams to coordinate content updates, reviews, and publishing, functioning as a specialized administrative layer within the larger Drupal framework.

What does CWE-862 mean for CVE-2026-10768?

CWE-862 is the classification for a Missing Authorization weakness. In the context of this CVE, it means the software fails to verify if a user has permission to perform a specific action or view a specific page. Because this check is absent, an attacker can bypass standard security restrictions and access parts of the site intended only for authorized users.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw through forceful browsing, which involves manually requesting specific, restricted URLs or endpoints that the software fails to protect. The vulnerability does not require the attacker to have an account or provide valid credentials. Simply knowing or guessing the path to a restricted workflow function allows the unauthorized access to occur.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal indicates this vulnerability is likely relevant because LocalGov Workflows operates within Drupal, a platform typically deployed as a public-facing web application. Since these interfaces are often reachable directly from the internet, the barrier for an attacker to reach these unauthorized endpoints is low, making internet-connected instances a primary concern.

What should I do if I use this software?

Start by identifying every instance of the LocalGov Workflows module running in your environment. Once you have an inventory, determine which sites are accessible from the public internet versus those on private networks. Prioritize securing any internet-facing instances, and coordinate with your Drupal site administrators to review official security updates or guidance provided by the Drupal project.

References

www.drupal.org/sa-contrib-2026-039

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.