SA-CONTRIB-2026-297: Critical severity composer/drupal/workflow_notifications vulnerability

Q: Who could exploit this issue?

An attacker who can access the Notification settings page may be able to make unauthorized changes. The available information does not specify the required role, permission, or authentication level.

Q: What functionality is at risk if the issue is exploited?

Notification settings for messages sent to users on Workflow state changes can be modified without authorization. This could affect how notifications are configured for workflow transitions.

Q: How can I determine whether my site may be affected?

Review whether the site uses the composer/drupal/workflow_notifications module and whether its Notification settings page is accessible. The provided information does not identify affected versions or a specific detection method.

Published Nov 4, 2026

Updated

This module enables you to send messages ("Notifications") to users upon a certain Workflow state change. The module doesn't sufficiently protect the Notification settings page where an attacker can make unauthorized changes.

Credit

Marcus Johansson (marcus_johansson)

Affected Software

1 affected componentFixes available

composer/drupal/workflow_notifications<3.0.3

3.0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/workflow_notifications to a version that resolves this vulnerability.
Fixed in 3.0.3

Event History

Nov 4, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-122066

Frequently Asked Questions

Who could exploit this issue?

An attacker who can access the Notification settings page may be able to make unauthorized changes. The available information does not specify the required role, permission, or authentication level.

What functionality is at risk if the issue is exploited?

Notification settings for messages sent to users on Workflow state changes can be modified without authorization. This could affect how notifications are configured for workflow transitions.

How can I determine whether my site may be affected?

Review whether the site uses the composer/drupal/workflow_notifications module and whether its Notification settings page is accessible. The provided information does not identify affected versions or a specific detection method.

SA-CONTRIB-2026-297: Critical severity composer/drupal/workflow_notifications vulnerability

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who could exploit this issue?

What functionality is at risk if the issue is exploited?

How can I determine whether my site may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who could exploit this issue?

What functionality is at risk if the issue is exploited?

How can I determine whether my site may be affected?