CVE-2026-96391

MediumCVSS 4.3

Published: 22/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

23th percentile - higher than 23% of all known CVEs

Summary

A missing authorization vulnerability in the Drupal Webform REST module allows forceful browsing. This issue affects Webform REST versions from 0.0.0 to 4.2.1.

Risk Assessment

An attacker may gain access to resources or functions they are not authorized to use, potentially exposing data or performing unauthorized actions.

Recommendation

Update the Webform REST module to a version later than 4.2.1 that fixes this vulnerability. Check for any other vulnerabilities in the module.

Other vulnerabilities in Drupal Webform REST

CVE-2026-16644Critical
Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects versions from 0.0.0 to 4.1.0.

Original NVD description (English source)

Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS