Is CVE-2026-16644 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16644 being exploited in the wild.

How severe is CVE-2026-16644?

Critical severity, with a CVSS score of 9.1, published 25 August 2026.

Which products and versions are affected?

Drupal Webform REST before 4.1.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform Rest ECOSYSTEM:introduced=0,fixed=4.1.0.

Is there a fix for CVE-2026-16644?

Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform Rest: upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-16644 attacked?

It is attacked over the network.

Am I affected by CVE-2026-16644?

Check whether you run Drupal Webform REST or Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform Rest at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16644: Drupal Webform REST access bypass in permission checks

CVE-2026-16644 · Severity: critical · CVSS 9.1 · Published 2026-08-25

Drupal Webform REST is a module that allows retrieval and submission of web forms through API endpoints. An authorization flaw permits attackers with access to the REST API to bypass permission checks on webform creation, viewing, and updating operations, potentially exposing or modifying form submissions that should be restricted. The vulnerability only affects older versions (4.0.3 and earlier).

Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-16644 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16644 being exploited in the wild.
How severe is CVE-2026-16644?: Critical severity, with a CVSS score of 9.1, published 25 August 2026.
Which products and versions are affected?: Drupal Webform REST before 4.1.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform Rest ECOSYSTEM:introduced=0,fixed=4.1.0.
Is there a fix for CVE-2026-16644?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform Rest: upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-16644 attacked?: It is attacked over the network.
Am I affected by CVE-2026-16644?: Check whether you run Drupal Webform REST or Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform Rest at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform Rest: upgrade to 4.1.0 or later

Technical details

An access bypass vulnerability exists in Drupal Webform REST due to insufficient permission verification of the parent webform when handling REST API requests for creating, viewing, and updating webform submissions. The vulnerable component is the REST resource endpoint handler. An attacker must already have permissions to access the REST resource, but can then perform actions on webform submissions beyond their authorized scope. The attack is network-based and does not require user interaction. Versions 4.1.0 and later, as well as 4.2.0+, include fixes for this issue.

Affected products

Drupal Webform REST before 4.1.0

Identifiers

CVE-2026-16644
DRUPAL-CONTRIB-2026-087

Timeline

2026-07-22: disclosed: Drupal Security Advisory SA-CONTRIB-2026-087 published
2026: patched: Fixed in versions 4.1.0 and 4.2.0
2026-08-25: advisory: CVE-2026-16644 recorded in NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.