CVE-2026-16644: Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087

Check the installed Drupal Webform REST version. Versions from 0.0.0 through 4.1.0 are identified as affected.

No fixed release, mitigation, or configuration workaround is specified in the provided data.

Published Aug 25, 2026

Updated

Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.

Affected Software

1 affected component

Drupal Webform REST>=0.0.0<=4.1.0

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade drupal/webform_rest to a version that resolves this vulnerability.
Fixed in 4.1.0Patch SA-CONTRIB-2026-087

Aug 25, 2026

CVE Published

via MITRE·10:21 PM

Data Sourced

via MITRE·10:21 PM

DescriptionWeakness

Data Sourced

via NVD·11:16 PM

DescriptionWeakness

Check the installed Drupal Webform REST version. Versions from 0.0.0 through 4.1.0 are identified as affected.

No fixed release, mitigation, or configuration workaround is specified in the provided data.