CVE-2026-16644: Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087
Published Aug 25, 2026
·Updated
Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.
Affected Software
1 affected component
Drupal Webform REST>=0.0.0<=4.1.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/webform_restto a version that resolves this vulnerability.Fixed in 4.1.0Patch SA-CONTRIB-2026-087
Event History
Aug 25, 2026
CVE Published
via MITRE·10:21 PM
Data Sourced
via MITRE·10:21 PM
DescriptionWeakness
Data Sourced
via NVD·11:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
How can I determine whether my site is in the affected version range?
Check the installed Drupal Webform REST version. Versions from 0.0.0 through 4.1.0 are identified as affected.
2
Does the available advisory data specify a fixed version or workaround?
No fixed release, mitigation, or configuration workaround is specified in the provided data.