Is CVE-2026-96391 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96391 being exploited in the wild.

How severe is CVE-2026-96391?

Informational severity, published 22 October 2026.

Which products and versions are affected?

Drupal Webform REST before 4.2.1; Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform Rest ECOSYSTEM:introduced=0,fixed=4.2.1.

Is there a fix for CVE-2026-96391?

Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform Rest: upgrade to 4.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-96391 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-96391?

Check whether you run Drupal Webform REST or Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform Rest at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96391: Drupal Webform REST module access bypass in permission checks

CVE-2026-96391 · Severity: info · Published 2026-10-22

The Webform REST module for Drupal enables external systems to retrieve and submit web forms via REST API calls. A permission check flaw allows unauthenticated or unauthorized users to access webform elements and submission data that they should not have permission to view or retrieve, potentially exposing sensitive form content and collected data.

Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-96391 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96391 being exploited in the wild.
How severe is CVE-2026-96391?: Informational severity, published 22 October 2026.
Which products and versions are affected?: Drupal Webform REST before 4.2.1; Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform Rest ECOSYSTEM:introduced=0,fixed=4.2.1.
Is there a fix for CVE-2026-96391?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform Rest: upgrade to 4.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96391 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-96391?: Check whether you run Drupal Webform REST or Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform Rest at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform Rest: upgrade to 4.2.1 or later

Technical details

The module fails to adequately validate permissions when processing REST API requests to retrieve webform elements or submission entities. An attacker can bypass access controls by calling the REST endpoint directly, gaining unauthorized read access to webform structure and submitted data. The vulnerability requires network access to the REST endpoint but no authentication credentials; a fix is available in version 4.2.1.

Affected products

Drupal Webform REST before 4.2.1

Identifiers

CVE-2026-96391
DRUPAL-CONTRIB-2026-186

Timeline

2026-09-23: disclosed
2026-09-23: patched: Fixed in version 4.2.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.