CVE-2026-96391
Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186
Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186
Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.
- Record
CVE-2026-96391- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2026-107815
Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.
- Record
EUVD-2026-107815- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-pp56-wg7c-j5hh
Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue...
Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.
- Record
GHSA-pp56-wg7c-j5hh- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
NVD
Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.
- Record
CVE-2026-96391- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSV
Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186
Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.
- Record
CVE-2026-96391- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVDRUPAL-CONTRIB-2026-186 No score
This module enables you to retrieve and submit webforms via REST.
The module doesn't sufficiently check permission to webform and webform submission entities when retrieving webform elements or fields.
- Record
DRUPAL-CONTRIB-2026-186- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/webform_restPackagist:https://packages.drupal.org/8 |
before 4.2.1 | 4.2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-96391 is a medium vulnerability (CVSS 4.3) in Drupal Webform Rest, published September 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in drupal/webform_rest 4.2.1.