{"id":"CVE-2026-16644","aliases":["DRUPAL-CONTRIB-2026-087","EUVD-2026-66203","GHSA-6fwm-vrgx-rjw7"],"status":"published","title":"Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087","description":"Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.0044,"percentile":0.38551,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-07-22T18:00:53Z","modified":"2026-10-28T02:30:36Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/webform_rest","fixed_in":["4.1.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/webform_rest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0"}]}]}],"products":[{"vendor":"drupal","product":"webform rest"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-087","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16644","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6fwm-vrgx-rjw7"},{"url":"https://git.drupalcode.org/project/webform_rest","tags":["web"]},{"url":"https://www.drupal.org/project/webform_rest","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16644.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-16644","title":"Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087","description":"Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.","status":"published","published":"2026-08-25T22:21:51.345Z","modified":"2026-08-26T18:40:31.903Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:20:11.24076Z"}],"euvd":[{"id":"EUVD-2026-66203","description":"Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.","status":"published","published":"2026-08-25T22:21:51Z","modified":"2026-08-26T18:40:31Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T18:01:29.635922Z"}],"ghsa":[{"id":"GHSA-6fwm-vrgx-rjw7","title":"Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue...","description":"Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.","status":"published","published":"2026-08-26T00:31:02Z","modified":"2026-08-26T21:32:44Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:11:02.000078Z"}],"nvd":[{"id":"CVE-2026-16644","description":"Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.","status":"published","published":"2026-08-25T23:16:57.2Z","modified":"2026-08-28T15:29:44.967Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:41.66469Z"}],"osv":[{"id":"CVE-2026-16644","title":"Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087","description":"Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.","status":"published","published":"2026-08-25T22:21:51.345Z","modified":"2026-10-28T02:30:36.450122146Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:44:57.682091Z"},{"id":"DRUPAL-CONTRIB-2026-087","description":"This module enables you to retrieve and submit webform submissions via REST endpoints.\n\nThe module doesn't sufficiently check the parent webform's permissions for creating, viewing and updating permissions.\n\nThis vulnerability is mitigated by the fact that an attacker must already have permissions to use the rest resource.\n\nThis advisory only affects already-unsupported versions 4.0.3 and earlier.","status":"published","published":"2026-07-22T18:00:53Z","modified":"2026-09-10T03:46:18.161588806Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}