CVE-2026-10768: Drupal LocalGov Auth Bypass Vulnerability

CVE-2026-10768 Overview

CVE-2026-10768 is a missing authorization vulnerability in the Drupal LocalGov Workflows contributed module. The flaw permits forceful browsing, allowing unauthenticated network attackers to access resources protected by workflow state restrictions. The issue affects LocalGov Workflows versions 0.0.0 through 1.6.0. The weakness is categorized under CWE-862: Missing Authorization. Successful exploitation compromises confidentiality, integrity, and availability of impacted Drupal sites.

Critical Impact
Unauthenticated remote attackers can bypass workflow authorization checks and access, modify, or disrupt content managed by the LocalGov Workflows module without user interaction.

Affected Products

Drupal LocalGov Workflows module versions 0.0.0 through 1.6.0
Drupal sites deploying the LocalGov Drupal distribution with the affected module enabled
Local government web platforms relying on LocalGov Workflows for editorial state control

Discovery Timeline

2026-07-10 - CVE-2026-10768 published to the National Vulnerability Database
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-10768

Vulnerability Analysis

The vulnerability resides in the Drupal LocalGov Workflows module, which manages editorial content states for local government websites. The module fails to enforce authorization checks on routes or resources that should be restricted by workflow state and user role.

Attackers exploit this weakness through forceful browsing. This technique involves directly requesting URLs or endpoints that the application assumes are hidden or unreachable through normal navigation. Because authorization is missing, the server returns protected content or accepts state-changing operations from unauthenticated requesters.

The attack requires no authentication, no user interaction, and low complexity. All three CIA properties are impacted, indicating attackers can read protected drafts, alter workflow states, and disrupt content publishing pipelines.

Root Cause

The root cause is an omitted access control check on workflow-related routes or entity operations within LocalGov Workflows. Drupal's routing system requires explicit _permission, _entity_access, or custom access callback declarations. The affected releases lack sufficient checks, so requests bypass permission enforcement and reach protected functionality directly.

Attack Vector

Exploitation occurs over the network against any publicly reachable Drupal site running an affected LocalGov Workflows version. An attacker enumerates or guesses workflow endpoint paths and issues HTTP requests directly to those paths. See the Drupal Security Advisory SA-CONTRIB-2026-039 for authoritative technical details.

No verified public proof-of-concept code is available at the time of publication. The EPSS score is 0.331% with a percentile of 25.3.

Detection Methods for CVE-2026-10768

Indicators of Compromise

Unauthenticated HTTP requests to LocalGov Workflows routes, particularly paths containing /localgov or workflow transition endpoints
Unexpected workflow state transitions in Drupal watchdog logs without an associated authenticated user ID
Access log entries showing 200 OK responses to workflow endpoints from sessions lacking valid authentication cookies

Detection Strategies

Review Drupal database logs (watchdog table) for content state changes attributed to the anonymous user or unexpected accounts
Enable and monitor Drupal access logging modules to capture requests targeting workflow transition URLs
Correlate web server access logs with authenticated session activity to surface direct URL access patterns consistent with forceful browsing

Monitoring Recommendations

Alert on HTTP requests to LocalGov Workflows endpoints originating from clients without an authenticated session cookie
Track sudden increases in workflow state transitions or content edits outside business hours
Monitor for reconnaissance patterns such as sequential path enumeration against Drupal admin and workflow routes

How to Mitigate CVE-2026-10768

Immediate Actions Required

Upgrade the LocalGov Workflows module to a fixed release above version 1.6.0 as identified in the Drupal Security Advisory
Audit Drupal watchdog logs and content revisions for unauthorized state changes since the module was deployed
Restrict access to Drupal administrative and workflow paths behind an authenticated reverse proxy or VPN where feasible

Patch Information

Drupal has published fix guidance in advisory SA-CONTRIB-2026-039. Site operators must update LocalGov Workflows to the patched release listed in that advisory. Clear Drupal caches after the update using drush cr to ensure new route access checks take effect.

Workarounds

Temporarily disable the LocalGov Workflows module until the patched version is deployed if editorial workflows can be paused
Deploy Web Application Firewall (WAF) rules to block unauthenticated requests to LocalGov Workflows endpoints
Enforce authentication at the reverse proxy for all /admin and workflow-related paths as a defense-in-depth control

bash

# Update the LocalGov Workflows module using Composer and clear caches
composer update drupal/localgov_workflows --with-dependencies
vendor/bin/drush updatedb
vendor/bin/drush cache:rebuild