Live › vulnerability › CVE-2026-84921
Go to dashboardThe Webform Submissions Delete module for Drupal lacks an authorization check, so a user can reach its delete function without permission. An attacker can remove webform submissions they should not be able to touch.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Drupal Webform Submissions Delete module at version 1.2.0 or earlier, where the module is enabled. Sites without the module, or with it disabled, are not exposed by this entry.
No product ranges from the sources yet.
drush pm:list --filter=webform_submissions_delete or composer show drupal/webform_submissions_deletedrush pm:list --status=enabled1.2.0; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-84921")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.