Finn Lewis

**Name of the Vulnerable Software and Affected Versions** LocalGov Workflows versions 0.0.0 through 1.6.0 **Description** Missing authorization allows forceful browsing within the module, which configures default editorial workflows for content types, including content moderation, approvals dashboards, scheduling, and previews. The issue stems from insufficient access restrictions to a view of Service Contacts, which exposes the names and content items assigned to each Service Contact. **Recommendations** Update LocalGov Workflows to a version later than 1.6.0.