DRUPAL-CONTRIB-2026-297: Composer/drupal/workflow_notifications vulnerability

Q: Which deployments should assess this issue?

Drupal sites using the composer/drupal/workflow_notifications module should assess access to the Notification settings page, because the issue permits unauthorized changes to notification configuration.

Published Nov 4, 2026

Updated

This module enables you to send messages ("Notifications") to users upon a certain Workflow state change.

The module doesn't sufficiently protect the Notification settings page where an attacker can make unauthorized changes.

Affected Software

1 affected componentFixes available

composer/drupal/workflow_notifications<3.0.3

3.0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/workflow_notifications to a version that resolves this vulnerability.
Fixed in 3.0.3

Event History

Nov 4, 2026

Advisory Published

via OSV·05:31 PM

Data Sourced

via OSV·05:31 PM

DescriptionAffected Software

Frequently Asked Questions

Which deployments should assess this issue?

Drupal sites using the composer/drupal/workflow_notifications module should assess access to the Notification settings page, because the issue permits unauthorized changes to notification configuration.