Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Project:
Date:
2026-June-03
Vulnerability:
Information disclosure
Affected versions:
<1.6.0
CVE IDs:
CVE-2026-10768
Description:
This module configures default editorial workflows for LocalGov Drupal content types. It provides a Drupal content moderation workflow, a content approvals dashboard, content scheduling and content preview.
The module doesn't sufficiently restrict access to a view of Service Contacts at which exposes the names and content items assigned to each Service Contact.
Solution:
Install the latest version:
- If you use the LocalGov Workflows module for Drupal, upgrade to LocalGov Workflows 1.6.0
Reported By:
Coordinated By:
- Greg Knaddison (greggles) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
