This vulnerability in Drupal FlowDrop (CVE-2026-58590) is classified as CWE-862 (Missing Authorization). It allows an attacker with low privileges to perform forceful browsing, potentially accessing resources or functionality without proper authorization checks. The affected versions include all releases from 0.0.0 through 1.6.0. The CVSS 3.1 base score is 5.4, reflecting a network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. No vendor advisory or patch information is available, and no known exploits have been reported.

The vulnerability allows unauthorized access to certain resources or functions within the Drupal FlowDrop module by bypassing authorization controls. This can lead to limited confidentiality and integrity impacts, such as unauthorized viewing or modification of data. There is no impact on availability. The medium severity rating and CVSS score of 5.4 reflect these impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Drupal FlowDrop module to trusted users only and monitor for unusual access patterns related to forceful browsing attempts.