Skip to content
OpenAdvisories
Unscored CVE-2026-122066 DRUPAL-CONTRIB-2026-297

This module enables you to send messages ("Notifications") to users upon a certain Workflow state change. The module doesn't sufficiently p…

Published Nov 4, 2026 · Updated Nov 4, 2026 · Assigned by DRUPAL

Package: drupal/workflow_notifications Ecosystem: Packagist

Description

This module enables you to send messages ("Notifications") to users upon a certain Workflow state change.

The module doesn't sufficiently protect the Notification settings page where an attacker can make unauthorized changes.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist drupal/workflow_notifications < 3.0.3 3.0.3 DRUPAL-CONTRIB-2026-297

Advisories 1

References