CVE-2026-84921
CVE-2026-84921 · Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.
CVSS 5.3 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
webform submissions delete
- Versions
- ≥ 0.0.0, < 1.2.0: Affected (semver)
Update to 1.2.0
drupal/webform_submissions_delete Packagist:https://packages.drupal.org/8
- Affected ranges
- ECOSYSTEM: < 1.2.0
Update to 1.2.0