CVE-2026-58590

Executive Summary

CVE-2026-58590 is a Missing Authorization vulnerability in the Drupal FlowDrop module (versions 0.0.0 to 1.6.0). This flaw allows an unauthenticated attacker to perform Forceful Browsing, bypassing access controls to access restricted resources, such as uploaded files or administrative endpoints. The vulnerability has a CVSS score of 0.0 (placeholder) but based on the description, it likely scores high in confidentiality impact. No public exploit code or proof-of-concept is currently available, and no official patch has been released by Drupal. The EPSS score is 0.0%, indicating low exploitation activity at this time.

Supply Chain & Package Security

This vulnerability affects a Drupal module (FlowDrop), which is part of the Drupal CMS ecosystem. Drupal modules are distributed via the Drupal.org project page and can be installed via Composer. The lack of a patch means that all installations using FlowDrop up to version 1.6.0 are at risk. Organizations should audit their Drupal installations for this module and consider removing or disabling it until a fix is available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): High (H) – Sensitive data can be accessed.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High (Confidentiality impact is High, and exploitation requires no privileges).

Deep Dive & Mechanics

The FlowDrop module for Drupal provides file upload and management capabilities. The vulnerability lies in the module's failure to properly enforce authorization checks when accessing certain endpoints or resources. An attacker can directly request URLs that should be protected, such as file download links or administrative actions, without proper authentication or permission validation.

Root Cause: The module does not implement Drupal's standard access control checks (e.g., hook_menu access callbacks or entity access checks) for certain routes. This allows unauthenticated users to perform Forceful Browsing – guessing or enumerating URLs to access restricted content.

Attack Vector:

1. An attacker identifies the FlowDrop module is installed (e.g., via HTTP headers, page source, or known paths).
2. The attacker crafts HTTP requests to known or guessable endpoints, such as /flowdrop/files/ or /flowdrop/admin/.
3. The server responds with sensitive data (e.g., uploaded files, configuration details) without requiring authentication.

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code is the entire FlowDrop module up to version 1.6.0. A hypothetical patch would involve adding access checks to all routes.

Vulnerable Code (Example):

// flowdrop.module
function flowdrop_menu() {
  $items['flowdrop/files/%'] = array(
    'title' => 'Download file',
    'page callback' => 'flowdrop_download_file',
    'access arguments' => array('access content'), // Incorrect: allows anonymous users
    'type' => MENU_CALLBACK,
  );
  return $items;
}

Patched Code (Hypothetical):

// flowdrop.module
function flowdrop_menu() {
  $items['flowdrop/files/%'] = array(
    'title' => 'Download file',
    'page callback' => 'flowdrop_download_file',
    'access callback' => 'user_access',
    'access arguments' => array('administer flowdrop'), // Proper permission
    'type' => MENU_CALLBACK,
  );
  return $items;
}

Exploitation & Lab Setup

Red Team

Objective: Exploit the missing authorization to access sensitive files.

Lab Setup:

1. Install Drupal 10.x with FlowDrop module version 1.6.0.
2. Upload a test file via the module's interface (if available) or ensure there are existing files.
3. Identify the file download URL pattern (e.g., /flowdrop/files/123).

Exploitation Steps:

1. Use curl to attempt to access a file without authentication:

   curl -v http://target.com/flowdrop/files/1
   

2. If successful, the server returns the file content. Enumerate file IDs:

   for i in {1..100}; do curl -s -o /dev/null -w "%{http_code}" http://target.com/flowdrop/files/$i; done
   

3. Automate with a script to download all accessible files.

Blue Team

Detection:

• Monitor HTTP access logs for repeated requests to /flowdrop/files/ or /flowdrop/admin/ from unknown IPs.
• Look for 200 OK responses to these endpoints from unauthenticated users.

Mitigation:

• Disable or remove the FlowDrop module until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block access to /flowdrop/* paths for unauthenticated users.
• Use Drupal's built-in access control to restrict the module's routes.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /flowdrop/files/ or /flowdrop/admin/ without a valid session cookie.
  • Unusual file download patterns (e.g., sequential file IDs).
• File IOCs:
  • Presence of the FlowDrop module in /modules/contrib/flowdrop/ (version <= 1.6.0).
• Log IOCs:
  • Drupal watchdog logs showing access to flowdrop routes by anonymous users.

Detection Engineering

YARA Rule

rule Detect_FlowDrop_Vulnerable_Module {
    meta:
        description = "Detects vulnerable FlowDrop module files (<= 1.6.0)"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-58590"
    strings:
        $module_info = "name = FlowDrop" nocase
        $version_low = "version = \"1.6.0\"" nocase
        $version_older = "version = \"1." nocase
    condition:
        $module_info and ($version_low or $version_older)
}

Sigma Rule

title: FlowDrop Unauthenticated File Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2026-58590 by accessing FlowDrop file endpoints without authentication.
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|startswith: '/flowdrop/files/'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate authenticated users (if any)
level: high

Suricata Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"CVE-2026-58590 - FlowDrop Unauthenticated File Access Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/flowdrop/files/"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Disable or uninstall the FlowDrop module from all Drupal installations.
2. Short-term: Implement a WAF rule to block unauthenticated access to /flowdrop/* paths.
3. Long-term: Monitor the Drupal.org project page for an official patch. Once available, update to a patched version (> 1.6.0).
4. Compensating Controls: Use Drupal's permissions system to restrict access to the module's routes. For example, add a custom module that overrides the menu router with proper access checks.
5. Audit: Review server logs for any signs of exploitation (e.g., repeated 200 responses to /flowdrop/files/).

Valters IT
DevSecOps & Cyber Threat Intelligence