This vulnerability (CVE-2026-10768) in Drupal LocalGov Workflows is classified as CWE-862 (Missing Authorization). It permits unauthorized access through forceful browsing due to missing authorization checks. The affected versions include all releases from 0.0.0 through 1.6.0. The CVSS v3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation depends on vendor updates or user mitigations.

Exploitation of this vulnerability can lead to unauthorized access to sensitive workflows or data within the Drupal LocalGov Workflows module. The attacker can bypass authorization controls, resulting in full compromise of confidentiality, integrity, and availability of the affected system. This could allow attackers to view, modify, or delete data and disrupt normal operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Drupal security advisories for updates. Until a patch is released, consider restricting access to the LocalGov Workflows module and implementing additional access controls or network-level restrictions to limit exposure.