CVE-2026-16644
CVE-2026-16644 · Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.
CVSS 9.1 · Critical · EPSS 0.4% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
webform rest
- Versions
- ≥ 0.0.0, < 4.1.0: Affected (semver)
Update to 4.1.0
drupal/webform_rest Packagist:https://packages.drupal.org/8
- Affected ranges
- ECOSYSTEM: < 4.1.0
Update to 4.1.0