Live › vulnerability › CVE-2026-96391
Go to dashboardThe Webform REST module for Drupal fails to check authorization on some endpoints, so requests can reach data that should be restricted. An attacker who can send requests to the site can read webform resources they should not see.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Webform REST module at version 4.2.1 or earlier that expose its REST endpoints. Sites without Webform REST installed, or with its REST resources disabled, are not exposed. The sources do not say which exact endpoints or permissions are affected.
No product ranges from the sources yet.
drush pm:list --filter=webform_rest on the Drupal site, or look at the webform_rest entry in composer.lock.4.2.1, as the affected range runs up to and including 4.2.1.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-96391")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.