Executive brief
The Webform REST module for Drupal enables external systems to retrieve and submit web forms via REST API calls. A permission check flaw allows unauthenticated or unauthorized users to access webform elements and submission data that they should not have permission to view or retrieve, potentially exposing sensitive form content and collected data.
Technical details
The module fails to adequately validate permissions when processing REST API requests to retrieve webform elements or submission entities. An attacker can bypass access controls by calling the REST endpoint directly, gaining unauthorized read access to webform structure and submitted data. The vulnerability requires network access to the REST endpoint but no authentication credentials; a fix is available in version 4.2.1.
Affected products
- Drupal Webform REST before 4.2.1
Timeline
- 2026-09-23: disclosed
- 2026-09-23: patched: Fixed in version 4.2.1