CVE-2026-10768

Name of the Vulnerable Software and Affected Versions LocalGov Workflows versions 0.0.0 through 1.6.0

Description Missing authorization allows forceful browsing within the module, which configures default editorial workflows for content types, including content moderation, approvals dashboards, scheduling, and previews. The issue stems from insufficient access restrictions to a view of Service Contacts, which exposes the names and content items assigned to each Service Contact.

Recommendations Update LocalGov Workflows to a version later than 1.6.0.