CVE-2026-122066 drupal CVE debrief

Who should care

Site administrators and security teams using the Workflow Notifications module for Drupal should assess exposure and take necessary actions to protect their sites.

Why it matters

The CVE-2026-122066 vulnerability in the Workflow Notifications module for Drupal allows unauthorized changes to the Notification settings page. Defenders should verify exposure, review access controls, and update the module to prevent potential security risks.

• Verify exposure by checking if the Workflow Notifications module is installed and enabled
• Review and strengthen access controls for the Notification settings page
• Update the module to version 3.0.3 or later if currently using a vulnerable version
• Monitor for unauthorized changes to Notification settings

Technical summary

The Workflow Notifications module for Drupal does not sufficiently protect the Notification settings page, allowing unauthorized changes. This issue affects sites using the module, particularly those with untrusted users or workflows that trigger notifications.

Defensive priority

Defenders should prioritize verifying exposure, reviewing Notification settings page access controls, and updating the module to version 3.0.3 or later if currently using a vulnerable version.

Recommended defensive actions

• Verify if the Workflow Notifications module is installed and enabled
• Review access controls for the Notification settings page
• Update the module to version 3.0.3 or later if currently using a vulnerable version
• Monitor for unauthorized changes to Notification settings

Evidence notes

The vulnerability details are based on the source item from osv_dev and the official CVE Program record. The source item provides information on the affected package and version range.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.