Description

Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-02T13:18:11.887Z",
  "pubdate": "2026-09-02T13:18:11.887Z",
  "executiveSummary": "The Content Moderation Notifications module for Drupal is susceptible to a Privilege Escalation vulnerability classified as a Privilege Defined With Unsafe Actions flaw.\nThis vulnerability enables an authenticated user to perform unauthorized actions or escalate their security permissions within the Drupal environment, bypassing standard role-based access control (RBAC) mechanisms.\nThe issue specifically impacts versions 0.0.0 through 3.9.0 of the Content Moderation Notifications module.\nThe risk is critical as it allows attackers with lower-level access to potentially gain administrative or elevated privileges, leading to complete compromise of site content or configuration.\nExploitation does not inherently require complex infrastructure but does necessitate the attacker to have an existing authenticated session or interaction with the vulnerable module functionality.\nThe primary impact is the unauthorized modification of sensitive data, site structural changes, or the illicit execution of privileged functions that are typically restricted to administrative roles.",
  "technicalDetails": "The vulnerability originates from the improper definition and validation of permissions within the Content Moderation Notifications module. The root cause is identified as a Privilege Defined With Unsafe Actions pattern, where the module logic fails to strictly enforce access control checks when executing specific internal routines related to notification triggers.\nUnder normal operating conditions, Drupal modules must verify that the current user has the appropriate 'permission' or 'role' before executing code that affects state or performs administrative tasks. In this module, specific actions are invoked without verifying if the requesting user possesses the necessary security clearance to perform the associated moderation or notification tasks.\nThe attack flow typically follows a pattern where an attacker leverages an existing, legitimate user account to interact with the module's exposed interfaces. By submitting requests that trigger the vulnerable notification logic, the attacker induces the application to execute privileged operations under the security context of the system rather than the context of the requesting user.\nBecause the logic improperly bridges the gap between low-privileged operations and high-privileged execution, an attacker can manipulate content moderation workflows in ways that lead to unauthorized state changes. This is essentially a failure in the mediation of privilege transitions within the module’s business logic.\nAffected versions 0.0.0 through 3.9.0 are universally vulnerable, as the permissive code paths are baked into the module's core functionality during state processing. The vulnerability resides in the notification dispatch engine where the module incorrectly assumes that the environment executing the trigger is already validated for elevated access.\nPost-exploitation, an attacker can effectively bypass the intended workflow restrictions. If the module allows notifications to act upon objects the user should not have access to, the attacker can leverage these hooks to modify content status, trigger unauthorized email notifications, or exploit other coupled modules that rely on the integrity of the Content Moderation Notifications module. The exploit is persistent and does not require active server-side code execution in a traditional RCE sense, as it leverages existing, legitimate administrative code that is simply being misdirected to execute at the command of an unauthorized principal."
}