Authorization Flaw in Drupal Webform Submissions Delete Affects User Data Management
CVE-2026-84921

Currently unrated

Key Information:

Vendor

Drupal
Status
Webform Submissions Delete
Vendor
CVE Published:
22 October 2026

What is CVE-2026-84921?

A missing authorization vulnerability in the Drupal Webform Submissions Delete module permits unauthorized users to access and delete submissions. This flaw enables forceful browsing, which could lead to unintended data exposure and deletion. Users of affected versions should promptly apply patches or updates to secure their installations.

Affected Version(s)

Webform Submissions Delete 0.0.0 < 1.2.0

References

https://www.drupal.org/sa-contrib-2026-133

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bernhard Karimi (bernhardk_oww)
solideogloria
Swan Kalata (akalata)
Damien McKenna (damienmckenna)
Dan Smith (galooph)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Pierre Rudloff (prudloff)
.