CVE-2026-58590: Drupal FlowDrop Module Human-in-the-Loop Approval Bypass Vulnerability
Summary
CVE-2026-58590: This module enables you to test and run AI-driven workflows interactively through a chat interface. Affects drupal/flowdrop versions < 1.6.0. Fixed in 1.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The FlowDrop module for Drupal enables users to create and manage AI-driven workflows through an interactive chat interface. It is designed to facilitate the integration of AI into various processes, allowing users to automate tasks efficiently. However, the module has a critical vulnerability that affects its approval mechanism, potentially leading to unintended workflow executions.
Vulnerability Detail
The vulnerability arises from the module's failure to adequately re-evaluate a human-in-the-loop approval gate during iterative workflow executions. This oversight can allow unauthorized or unintended workflows to be executed, posing a significant risk to users who rely on the module for critical tasks. An attacker must possess specific permissions, such as 'Administer FlowDrop workflows', to exploit this vulnerability, making it essential for administrators to review user roles and permissions carefully.
How To Fix
Minimum fixed version
1.6.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can restrict access to the permissions related to the FlowDrop workflows, ensuring that only trusted users can create or edit workflows. This can help minimize the risk of exploitation until the module is updated.
Conclusion
The CVE-2026-58590 vulnerability in the Drupal FlowDrop module poses a significant risk due to its flawed approval mechanism. Users are strongly advised to update to the latest version to mitigate potential exploitation. Additionally, implementing temporary access restrictions can help safeguard against unauthorized workflow executions until the update is applied.
See every vulnerability recorded for drupal/flowdrop →
FAQ
The FlowDrop module is a Drupal extension that allows users to create and manage AI-driven workflows through a chat interface.
The vulnerability allows workflows to be executed without proper human approval due to insufficient re-evaluation of the approval gate during iterative executions.
An attacker with permissions such as 'Administer FlowDrop workflows' can exploit this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, restrict access to the FlowDrop permissions to trusted users as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/flowdrop.
