CVE-2026-58589

MediumCVSS 5.4

Published: 10/07/2026(UTC)Updated: 14/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions from 0.0.0 to 1.6.0.

An attacker can gain unauthorized access to protected resources, leading to data leakage or system integrity compromise.

Update FlowDrop to version 1.6.1 or later, which includes the fix.

Original NVD description (English source)

Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS