Executive brief
FlowDrop is a Drupal module used to build and manage automated workflows, including those powered by AI. A security flaw in the module's chat interface could allow a user with limited administrative access to interfere with other users' active sessions or trigger unauthorized workflows. This could lead to unexpected costs from AI service usage or unauthorized actions being performed by the automated tools.
Technical details
A missing authorization (CWE-862) vulnerability exists in the Drupal FlowDrop module versions prior to 1.6.0. The module fails to sufficiently enforce permissions on specific endpoints related to its interactive chat interface. An attacker with the 'View any session' permission can exploit this to perform 'Forceful Browsing,' allowing them to trigger workflow executions—potentially incurring Large Language Model (LLM) costs and side effects—or inject messages into sessions belonging to other users. The fix introduces a new 'Execute session workflow' permission required to drive a session.
Affected products
- Drupal FlowDrop 0.0.0 to 1.5.x (fixed in 1.6.0)
Timeline
- 2026-07-01: patched: Version 1.6.0 released
- 2026-07-01: advisory: Drupal security advisory SA-CONTRIB-2026-067 published
- 2026-07-10: disclosed: CVE-2026-58589 published to NVD