CVE-2026-96391: Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186

Published Oct 22, 2026

Updated

Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Drupal Webform REST to a version that resolves this vulnerability.
Patch SA-CONTRIB-2026-186

Event History

Oct 22, 2026

CVE Published

via MITRE·01:21 AM

Data Sourced

via MITRE·01:21 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are affected?

Webform REST versions from 0.0.0 through 4.2.1 are affected.

What kind of access does an attacker need to exploit this issue?

The issue is an authorization bypass through forceful browsing. The provided information does not specify whether authentication or any particular role is required.

CVE-2026-96391: Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What kind of access does an attacker need to exploit this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What kind of access does an attacker need to exploit this issue?