[IT-SecNots] [Security-news] LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-039

Project: LocalGov Workflows [1]
Date: 2026-June-03
Security risk: *Moderately critical* 14 ∕ 25
AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2]
Vulnerability: Information disclosure

Affected versions: <1.6.0
CVE IDs: CVE-2026-10768
Description: 
This module configures default editorial workflows for LocalGov Drupal
content types. It provides a Drupal content moderation workflow, a content
approvals dashboard, content scheduling and content preview.

The module doesn't sufficiently restrict access to a view of Service Contacts
at which exposes the names and content items assigned to each Service
Contact.

Solution: 
Install the latest version:

 * If you use the LocalGov Workflows module for Drupal, upgrade to LocalGov
   Workflows 1.6.0 [3]

Reported By: 
 * Maria Young (maria.y) [4]

Fixed By: 
 * Finn Lewis (finn lewis) [5]
 * Rupert Jabelman (rupertj) [6]

Coordinated By: 
 * Greg Knaddison (greggles) [7] of the Drupal Security Team
 * Dave Long (longwave) [8] of the Drupal Security Team
 * Juraj Nemec (poker10) [9] of the Drupal Security Team

Security
issue: 
https://git.drupalcode.org/security/185130-localgov_workflows-security/-/work_it…
[10]
------------------------------------------------------------------------------
Contribution record [11]

[1] https://www.drupal.org/project/localgov_workflows
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/localgov_workflows/releases/1.6.0
[4] https://www.drupal.org/u/mariay-0
[5] https://www.drupal.org/u/finn-lewis
[6] https://www.drupal.org/u/rupertj
[7] https://www.drupal.org/u/greggles
[8] https://www.drupal.org/u/longwave
[9] https://www.drupal.org/u/poker10
[10]  
https://git.drupalcode.org/security/185130-localgov_workflows-security/-/work_items/1
[11]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3593121

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at