Junglewise Threat Intelligence

CVE-2026-96391: Drupal Webform REST module access bypass in permission checks

CVE-2026-96391 · Severity: info · Published 2026-09-23

Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Executive brief

The Webform REST module for Drupal enables external systems to retrieve and submit web forms via REST API calls. A permission check flaw allows unauthenticated or unauthorized users to access webform elements and submission data that they should not have permission to view or retrieve, potentially exposing sensitive form content and collected data.

Technical details

The module fails to adequately validate permissions when processing REST API requests to retrieve webform elements or submission entities. An attacker can bypass access controls by calling the REST endpoint directly, gaining unauthorized read access to webform structure and submitted data. The vulnerability requires network access to the REST endpoint but no authentication credentials; a fix is available in version 4.2.1.

Affected products

  • Drupal Webform REST before 4.2.1

Timeline

  • 2026-09-23: disclosed
  • 2026-09-23: patched: Fixed in version 4.2.1

References

Related threats