SA-CONTRIB-2026-186: Critical severity drupal/webform_rest vulnerability
This module enables you to retrieve and submit webforms via REST. The module doesn't sufficiently check permission to webform and webform submission entities when retrieving webform elements or fields.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/webform_restto a version that resolves this vulnerability.Fixed in 4.2.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the drupal/webform_rest module are exposed if they provide REST access to webform elements or fields. The issue concerns insufficient permission checks on webform and webform submission entities during retrieval.
What access would an attacker need?
The available information indicates that exploitation involves retrieving webform elements or fields through the module's REST functionality. It does not state whether authentication is required or which specific permissions an attacker must have.
How can administrators determine whether they may be affected?
Review whether drupal/webform_rest is installed and used to retrieve or submit webforms through REST. Also identify REST endpoints or integrations that expose webform elements, fields, or submission-related entities.