{"id":"CVE-2026-84921","kind":"vulnerability","aliases":["CVE-2026-84921"],"related":[],"title":"Drupal Webform Submissions Delete: missing access check lets users delete submissions","description":"Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.","summary":"The Webform Submissions Delete module for Drupal lacks an authorization check, so a user can reach its delete function without permission. An attacker can remove webform submissions they should not be able to touch.","severity":"medium","cvss":5.3,"epss":0.00288,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","self-hosted","webform"],"not_affected_if":["module-disabled","module-not-installed"],"how_to_check":"- Check the installed version of the Webform Submissions Delete module with `drush pm:list --filter=webform_submissions_delete` or `composer show drupal/webform_submissions_delete`\n- Confirm whether the module is enabled on the site with `drush pm:list --status=enabled`","fix":"- Update the Webform Submissions Delete module to a release later than `1.2.0`; the sources do not name the fixed version\n- Until patched, disable the module if the bulk delete feature is not needed","status":"open","published_at":"2026-10-22T02:17:02+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:20:40+00:00","updated_at":"2026-10-25T04:20:40+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:20:40Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Webform Submissions Delete module to a release later than `1.2.0`; the sources do not name the fixed version\n- Until patched, disable the module if the bulk delete feature is not needed","reach":"internet","title":"Drupal Webform Submissions Delete: missing access check lets users delete submissions","impact":"medium","summary":"The Webform Submissions Delete module for Drupal lacks an authorization check, so a user can reach its delete function without permission. An attacker can remove webform submissions they should not be able to touch.","category":"package","nicknames":[],"who_cares":["drupal","webform","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"authenticated users delete webform submissions without permission","analyst_note":"","how_to_check":"- Check the installed version of the Webform Submissions Delete module with `drush pm:list --filter=webform_submissions_delete` or `composer show drupal/webform_submissions_delete`\n- Confirm whether the module is enabled on the site with `drush pm:list --status=enabled`","needs_analyst":false,"not_affected_if":["module-not-installed","module-disabled"],"who_is_affected":"Sites running the Drupal Webform Submissions Delete module at version 1.2.0 or earlier, where the module is enabled. Sites without the module, or with it disabled, are not exposed by this entry.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000589,"input_tokens":3329,"output_tokens":512,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-84921':14A,17A '0.0.0':77C '1.2.0':79C 'abl':55B 'access':6A 'affect':71C 'allow':66C 'attack':46B 'author':33B,59C 'brows':68C 'check':7A,34B 'cve':12A,15A 'delet':4A,10A,27B,41B,65C,74C 'drupal':1A,18B,30B,62C 'forc':67C 'function':42B 'host':22B 'issu':70C 'lack':31B 'let':8A 'miss':5A,58C 'modul':28B 'packag':19B 'permiss':44B 'reach':39B 'remov':48B 'self':21B 'self-host':20B 'submiss':3A,11A,26B,50B,64C,73C 'touch':57B 'user':9A,37B 'version':75C 'vulner':60C 'webform':2A,23B,25B,49B,63C,72C 'without':43B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Webform Submissions Delete module at version 1.2.0 or earlier, where the module is enabled. Sites without the module, or with it disabled, are not exposed by this entry.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84921","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84921","severity":null,"published_at":"2026-10-22T02:17:02+00:00","modified_at":"2026-10-22T18:17:30+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-84921","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84921","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}