CVE-2026-58589

The FlowDrop Drupal module (versions 0.0.0 to 1.6.0 ) contains a missing authorization vulnerability that allows for Forceful Browsing . Due to insufficient permission enforcement on specific endpoints, an attacker could potentially trigger workflow executions—leading to LLM spend and tool side e...

CVE-2026-58590

The FlowDrop module for Drupal (versions 0.0.0 through 1.6.0) is susceptible to a Missing Authorization vulnerability that allows for Forceful Browsing . The root cause is the module's failure to sufficiently re-evaluate human-in-the-loop approval gates when a workflow iterates more than once. Th...