CVE-2026-16644
Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087
Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087
Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.
- Record
CVE-2026-16644- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2026-66203
Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.
- Record
EUVD-2026-66203- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6fwm-vrgx-rjw7
Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue...
Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.
- Record
GHSA-6fwm-vrgx-rjw7- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.
- Record
CVE-2026-16644- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSV
Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087
Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.
- Record
CVE-2026-16644- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVDRUPAL-CONTRIB-2026-087 No score
This module enables you to retrieve and submit webform submissions via REST endpoints.
The module doesn't sufficiently check the parent webform's permissions for creating, viewing and updating permissions.
This vulnerability is mitigated by the fact that an attacker must already have permissions to use the rest resource.
This advisory only affects already-unsupported versions 4.0.3 and earlier.
- Record
DRUPAL-CONTRIB-2026-087- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/webform_restPackagist:https://packages.drupal.org/8 |
before 4.1.0 | 4.1.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-16644 is a critical vulnerability (CVSS 9.1) in Drupal Webform Rest, published July 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in drupal/webform_rest 4.1.0.