CVE-2026-122066: Composer/drupal/workflow_notifications vulnerability
Published Nov 4, 2026
·Updated
This module enables you to send messages ("Notifications") to users upon a certain Workflow state change.
The module doesn't sufficiently protect the Notification settings page where an attacker can make unauthorized changes.
Affected Software
1 affected componentFixes available
composer/drupal/workflow_notifications<3.0.3
3.0.3
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/workflow_notificationsto a version that resolves this vulnerability.Fixed in 3.0.3
Event History
Nov 4, 2026
Advisory Published
via OSV·05:31 PM
Data Sourced
via OSV·05:31 PM
DescriptionAffected Software
Frequently Asked Questions
1
Which package should be checked during inventory and remediation planning?
Check the Drupal package identified as composer/drupal/workflow_notifications.
2
How current is the available vulnerability information?
The vulnerability was published on 2026-11-04 and was also last modified on 2026-11-04.