CVE-2026-96391
CVE-2026-96391 · Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.
EPSS 0.2% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
webform rest
- Versions
- ≥ 0.0.0, < 4.2.1: Affected (semver)
Update to 4.2.1
drupal/webform_rest Packagist:https://packages.drupal.org/8
- Affected ranges
- ECOSYSTEM: < 4.2.1
Update to 4.2.1