CVE-2026-84921: Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133

Q: Which installations are affected?

Drupal installations using the Webform Submissions Delete module in versions from 0.0.0 through 1.2.0 are affected.

Q: What access does an attacker need to exploit this issue?

The issue is an authorization bypass through forceful browsing, meaning exploitation involves directly requesting functionality that should be access-controlled. The available information does not specify any required account role or authentication level.

Published Oct 22, 2026

Updated

Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.

Affected Software

1 affected component

Drupal Webform Submissions Delete>=0.0.0<=1.2.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SA-CONTRIB-2026-133

Event History

Oct 22, 2026

CVE Published

via MITRE·01:22 AM

Data Sourced

via MITRE·01:22 AM

DescriptionWeakness

Frequently Asked Questions

Which installations are affected?

Drupal installations using the Webform Submissions Delete module in versions from 0.0.0 through 1.2.0 are affected.

What access does an attacker need to exploit this issue?

The issue is an authorization bypass through forceful browsing, meaning exploitation involves directly requesting functionality that should be access-controlled. The available information does not specify any required account role or authentication level.

CVE-2026-84921: Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What access does an attacker need to exploit this issue?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What access does an attacker need to exploit this issue?