Skip to content
OpenAdvisories
Critical · 9.1 CVE-2026-16644 DRUPAL-CONTRIB-2026-087EUVD-2026-66203GHSA-6fwm-vrgx-rjw7

Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087

Published Aug 25, 2026 · Updated Aug 26, 2026 · Assigned by drupal

Vendor: Drupal Product: Webform REST Package: drupal/webform_rest Ecosystem: Packagist

Description

Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.

Affected products

VendorProductAffectedFixed
Drupal Webform REST 0.0.0 – < 4.1.0 4.1.0

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist drupal/webform_rest < 4.1.0 4.1.0 DRUPAL-CONTRIB-2026-087

Advisories 1

References