CVE-2026-58590: Flowdrop Auth Bypass Vulnerability

CVE-2026-58590 Overview

CVE-2026-58590 is a Missing Authorization vulnerability [CWE-862] in the Drupal FlowDrop contributed module. The flaw allows authenticated attackers to perform forceful browsing against resources that should require additional authorization checks. All FlowDrop releases from 0.0.0 through 1.6.0 are affected.

The issue exposes both confidentiality and integrity of protected content, since authorization checks are missing on endpoints reachable over the network. Exploitation requires low privileges and no user interaction, making it accessible to any authenticated site user.

Critical Impact
Authenticated attackers can bypass access controls in the FlowDrop module and access or modify resources through forceful browsing over the network.

Affected Products

Drupal FlowDrop module versions 0.0.0 through 1.6.0
Drupal sites with the FlowDrop contributed module installed and enabled
Any Drupal deployment relying on FlowDrop for content or workflow handling

Discovery Timeline

2026-07-10 - CVE-2026-58590 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-58590

Vulnerability Analysis

The vulnerability is classified as Missing Authorization under CWE-862. FlowDrop exposes functionality that does not verify whether the requesting user is authorized to access the target resource. An authenticated user can therefore reach endpoints or objects that should be restricted to higher-privileged roles.

Forceful browsing is the primary exploitation technique. The attacker manipulates predictable URLs, identifiers, or parameters to reach resources outside their intended scope. Because authorization enforcement is absent rather than merely weak, no privilege elevation or token forgery is required.

The attack vector is Network, complexity is Low, and only low privileges are required. Impact is limited to partial disclosure and partial modification of data. Availability is not affected. The EPSS probability is 0.23% with a percentile of 13.9, indicating a low observed likelihood of exploitation in the short term.

Root Cause

The FlowDrop module fails to enforce access control checks on protected routes or entities. Drupal's permission system and route access callbacks are not applied consistently across the affected code paths, leaving resources reachable to any authenticated user.

Attack Vector

An attacker with a valid account on the target Drupal site sends crafted HTTP requests to FlowDrop-provided URLs. By iterating identifiers or accessing routes directly, the attacker retrieves or alters records that the application intends to restrict. No specialized tooling is required beyond a standard web client. Refer to the Drupal Security Advisory for module-specific technical details.

Detection Methods for CVE-2026-58590

Indicators of Compromise

Repeated authenticated requests to FlowDrop routes with sequentially incremented entity or node identifiers
HTTP 200 responses to FlowDrop endpoints from user accounts that lack the associated Drupal permissions
Access log entries showing low-privilege accounts reaching administrative or workflow-specific FlowDrop paths

Detection Strategies

Audit Drupal watchdog and web server logs for FlowDrop URL patterns accessed by non-administrative roles
Correlate user role assignments with resources returned by FlowDrop responses to identify authorization gaps
Deploy application-layer rules that flag rapid identifier enumeration against FlowDrop endpoints

Monitoring Recommendations

Enable verbose access logging on Drupal and forward logs to a centralized analytics platform
Alert on anomalous request volumes to FlowDrop routes from a single authenticated session
Review Drupal role and permission changes on a recurring basis to confirm least-privilege configuration

How to Mitigate CVE-2026-58590

Immediate Actions Required

Upgrade the FlowDrop module to a version later than 1.6.0 once released by the maintainer
Restrict account creation and audit existing low-privilege accounts on affected Drupal sites
Review the Drupal Security Advisory SA-CONTRIB-2026-068 for the vendor-supplied fix guidance

Patch Information

The maintainer has issued guidance through the Drupal Security Advisory. Administrators should update FlowDrop to the fixed release identified in that advisory. Verify the installed version with drush pm:list --type=module --status=enabled | grep flowdrop after upgrading.

Workarounds

Disable the FlowDrop module until a patched version is deployed if the functionality is not business-critical
Add web server or reverse-proxy access rules that restrict FlowDrop routes to trusted roles or IP ranges
Apply Drupal permission hardening to reduce the set of users capable of authenticating to the site

bash

# Configuration example: disable the FlowDrop module with Drush
drush pm:uninstall flowdrop
drush cache:rebuild