{"id":"CVE-2026-96391","kind":"vulnerability","aliases":["CVE-2026-96391"],"related":[],"title":"Drupal Webform REST: missing authorization lets users browse forbidden data","description":"Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.","summary":"The Webform REST module for Drupal fails to check authorization on some endpoints, so requests can reach data that should be restricted. An attacker who can send requests to the site can read webform resources they should not see.","severity":"medium","cvss":null,"epss":0.00196,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","self-hosted","webform"],"not_affected_if":["rest-endpoints-disabled","webform-rest-not-installed"],"how_to_check":"- Check the installed Webform REST version with `drush pm:list --filter=webform_rest` on the Drupal site, or look at the `webform_rest` entry in `composer.lock`.\n- unknown","fix":"- Upgrade the Webform REST module to a version newer than `4.2.1`, as the affected range runs up to and including `4.2.1`.\n- unknown","status":"open","published_at":"2026-10-22T02:17:09+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T05:00:32+00:00","updated_at":"2026-10-25T05:00:32+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:00:32Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Webform REST module to a version newer than `4.2.1`, as the affected range runs up to and including `4.2.1`.\n- unknown","reach":"internet","title":"Drupal Webform REST: missing authorization lets users browse forbidden data","impact":"medium","summary":"The Webform REST module for Drupal fails to check authorization on some endpoints, so requests can reach data that should be restricted. An attacker who can send requests to the site can read webform resources they should not see.","category":"package","nicknames":[],"who_cares":["drupal","webform","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Unauthorized users may read restricted webform data over REST","analyst_note":"Check the Drupal security advisory for Webform REST and confirm which endpoints, permissions and fixed version apply; the NVD entry gives no severity or fixed version.","how_to_check":"- Check the installed Webform REST version with `drush pm:list --filter=webform_rest` on the Drupal site, or look at the `webform_rest` entry in `composer.lock`.\n- unknown","needs_analyst":true,"not_affected_if":["webform-rest-not-installed","rest-endpoints-disabled"],"who_is_affected":"Sites running the Webform REST module at version `4.2.1` or earlier that expose its REST endpoints. Sites without Webform REST installed, or with its REST resources disabled, are not exposed. The sources do not say which exact endpoints or permissions are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00061,"input_tokens":3306,"output_tokens":559,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-96391':13A,16A '0.0.0':79C '4.2.1':81C 'affect':74C 'allow':69C 'attack':46B 'author':5A,32B,63C 'brows':8A,71C 'check':31B 'cve':11A,14A 'data':10A,40B 'drupal':1A,17B,28B,66C 'endpoint':35B 'fail':29B 'forbidden':9A 'forc':70C 'host':21B 'issu':73C 'let':6A 'miss':4A,62C 'modul':26B 'packag':18B 'reach':39B 'read':55B 'request':37B,50B 'resourc':57B 'rest':3A,25B,68C,76C 'restrict':44B 'see':61B 'self':20B 'self-host':19B 'send':49B 'site':53B 'user':7A 'version':77C 'vulner':64C 'webform':2A,22B,24B,56B,67C,75C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Webform REST module at version `4.2.1` or earlier that expose its REST endpoints. Sites without Webform REST installed, or with its REST resources disabled, are not exposed. The sources do not say which exact endpoints or permissions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96391","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96391","severity":null,"published_at":"2026-10-22T02:17:09+00:00","modified_at":"2026-10-22T16:21:29+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96391","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96391","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}