Which products and versions are affected by CVE-2026-10768?

Affected: LocalGov Workflows (Localgovdrupal) versions >= 0.0.0; drupal/localgov_workflows (composer). The full list is in the CVE brief.

Is CVE-2026-10768 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2026-10768 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2026-10768?

No public exploit code is known.

Is there a fix for CVE-2026-10768?

Fixed versions are available, including drupal/localgov_workflows 1.6.0, LocalGov Workflows 1.6.0.

How urgently should CVE-2026-10768 be patched?

Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

Request A Demo

Vulnerability Intelligence

CVE-2026-10768

Critical

Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing.

Published Jun 3, 2026 · Updated Sep 10, 2026 · Also known as DRUPAL-CONTRIB-2026-039, EUVD-2026-43114

Key Facts

Patch in the next maintenance window

CVE-2026-10768 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting LocalGov Workflows (Localgovdrupal), drupal/localgov_workflows (composer).
It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
EPSS estimates a 2.1% probability of exploitation in the next 30 days.
Fixed versions are available, including drupal/localgov_workflows 1.6.0, LocalGov Workflows 1.6.0.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

CVSS v3.1

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

2.1%

Higher than 81.6% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2026-10768 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0.

Affected Products

5 affected entries in total

Product	Affected versions	Fixed in
LocalGov WorkflowsLocalgovdrupal	>= 0.0.0	1.6.0
drupal/localgov_workflowscomposer	See advisory	1.6.0

Patched Releases

drupal/localgov_workflows

1.6.0

LocalGov Workflows

1.6.0

Timeline

Publicly disclosed
Jun 3, 2026
Last updated
Sep 10, 2026

Weakness Type

CWE-862 Missing Authorization

References

FAQ

Common Questions.

Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing.
Affected: LocalGov Workflows (Localgovdrupal) versions >= 0.0.0; drupal/localgov_workflows (composer). The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including drupal/localgov_workflows 1.6.0, LocalGov Workflows 1.6.0.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

Is CVE-2026-10768 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.