CVE-2026-10768 LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039
Attackers can access restricted information in LocalGov Workflows due to missing authorization checks, requiring an upgrade to secure the module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-10768?
CVE-2026-10768 is a critical missing authorization vulnerability in Drupal LocalGov Workflows, published on 10 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0.
Weakness: CWE-862
Which versions are affected by CVE-2026-10768?
It affects 1 product.
Linux distribution packages (1)
drupal/localgov_workflows Packagist:https://packages.drupal.org/8 | All versions | 1.6.0 |
Products include Localgovdrupal Localgov Workflows.
How do I fix CVE-2026-10768?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-10768 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-10768 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as DRUPAL-CONTRIB-2026-039, GHSA-m5cq-wg24-c9f2.