CVE-2026-58589: Drupal Flowdrop Module Insufficient Permission Enforcement Vulnerability
Summary
CVE-2026-58589: This module enables you to test and run AI-driven workflows interactively through a chat interface. Affects drupal/flowdrop versions < 1.6.0. Fixed in 1.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Flowdrop module for Drupal enables users to test and run AI-driven workflows interactively through a chat interface. It is designed to facilitate the integration of AI tools into user workflows, allowing for a seamless interaction between users and AI functionalities. However, the module has been found to have a critical vulnerability that affects its permission management, potentially exposing sensitive functionalities to unauthorized users.
Vulnerability Detail
The Flowdrop module does not sufficiently enforce permissions on certain endpoints, which could allow attackers to trigger workflow execution without proper authorization. This could lead to unintended costs associated with LLM (Large Language Model) usage and may also allow attackers to send messages into other users' sessions. The vulnerability is particularly concerning as it requires the attacker to have the 'View any session' permission, which is not granted to anonymous or authenticated users by default, thus limiting the risk to a certain extent.
How To Fix
Minimum fixed version
1.6.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the Flowdrop module by adjusting user permissions in the Drupal admin panel. Navigate to 'People' > 'Permissions' and ensure that only trusted users are granted the 'View any session' permission until the module is updated.
Conclusion
The CVE-2026-58589 vulnerability in the Drupal Flowdrop module poses a risk due to insufficient permission enforcement, allowing unauthorized access to sensitive functionalities. It is crucial to update the module to version 1.6.0 or later to mitigate this risk. Additionally, users should consider temporary workarounds to limit exposure until the update is applied.
See every vulnerability recorded for drupal/flowdrop →
FAQ
The Flowdrop module is a Drupal extension that allows users to interact with AI-driven workflows through a chat interface.
This vulnerability allows unauthorized users to trigger workflow executions and send messages into other users' sessions due to insufficient permission enforcement.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider restricting user permissions related to the Flowdrop module as a temporary workaround.
For more information, you can reach out to Aincient Labs, the credited security researcher, via their Drupal profile.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/flowdrop.
