CVE-2026-16644
criticalpriority · track · 0OT risk · elevatedEPSS 0.004 · 38 %ileDEUSEPSS · scored 2026-10-28
Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.3–9.1
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
- Packagist:https://packages.drupal.org/8 drupal/webform_rest< 4.1.0osvUSpkg:composer/drupal/webform_rest?repository_url=https:%2F%2Fpackages.drupal.org%2F8
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-2474Drupal Module: Mehrere SchwachstellenDeutsch2026-07-22csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und weitere, nicht näher spezifizierte Angriffe durchzuführen.
- DRUPAL-CONTRIB-2026-0872026-07-22vendor · osvUS
This module enables you to retrieve and submit webform submissions via REST endpoints. The module doesn't sufficiently check the parent webform's permissions for creating, viewing and updating permissions. This vulnerability is mitigated by the fact that an attacker must already have permissions to use the rest resource. This advisory only affects already-unsupported versions 4.0.3 and earlier.
sources
Which sources assert this record, and when.
references (1) nvd
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan