Executive brief
Drupal Webform REST is a module that allows retrieval and submission of web forms through API endpoints. An authorization flaw permits attackers with access to the REST API to bypass permission checks on webform creation, viewing, and updating operations, potentially exposing or modifying form submissions that should be restricted. The vulnerability only affects older versions (4.0.3 and earlier).
Technical details
An access bypass vulnerability exists in Drupal Webform REST due to insufficient permission verification of the parent webform when handling REST API requests for creating, viewing, and updating webform submissions. The vulnerable component is the REST resource endpoint handler. An attacker must already have permissions to access the REST resource, but can then perform actions on webform submissions beyond their authorized scope. The attack is network-based and does not require user interaction. Versions 4.1.0 and later, as well as 4.2.0+, include fixes for this issue.
Affected products
- Drupal Webform REST before 4.1.0
Timeline
- 2026-07-22: disclosed: Drupal Security Advisory SA-CONTRIB-2026-087 published
- 2026: patched: Fixed in versions 4.1.0 and 4.2.0
- 2026-08-25: advisory: CVE-2026-16644 recorded in NVD