Missing Authorization Vulnerability in Drupal Webform REST by Drupal
CVE-2026-96391

Currently unrated

Key Information:

Vendor

Drupal
Status
Webform Rest
Vendor
CVE Published:
22 October 2026

What is CVE-2026-96391?

The Drupal Webform REST presents a vulnerability that allows unauthorized access via forceful browsing. This issue exists in versions ranging from 0.0.0 to 4.2.1, impacting the security of user data and application integrity. Users should take immediate action to mitigate this risk by applying the latest updates to ensure secure interactions with RESTful services.

Affected Version(s)

Webform REST 0.0.0 < 4.2.1

References

https://www.drupal.org/sa-contrib-2026-186

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lauri (laurii)
Adam Bramley (acbramley)
Miguel Ferreira (miguelpamferreira)
Swan Kalata (akalata)
Bram Driesen (bramdriesen)
cilefen (cilefen)
Greg Knaddison (greggles)
Mohit Aghera (mohit_aghera)
Juraj Nemec (poker10)
Jess (xjm)
.