Skip to content
OpenAdvisories
Medium · 4.3 CVE-2026-96391 DRUPAL-CONTRIB-2026-186EUVD-2026-107815GHSA-pp56-wg7c-j5hh

Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186

Published Oct 22, 2026 · Updated Oct 30, 2026 · Assigned by drupal

Vendor: Drupal Product: Webform REST Package: drupal/webform_rest Ecosystem: Packagist

Description

Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.

Affected products

VendorProductAffectedFixed
Drupal Webform REST 0.0.0 – < 4.2.1 4.2.1

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist drupal/webform_rest < 4.2.1 4.2.1 DRUPAL-CONTRIB-2026-186

Advisories 1

References