---
id: "CVE-2026-96391"
kind: "vulnerability"
aliases: ["CVE-2026-96391"]
title: "Drupal Webform REST: missing authorization lets users browse forbidden data"
severity: "medium"
cvss: null
epss: 0.00196
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "package", "self-hosted", "webform"]
not_affected_if: ["rest-endpoints-disabled", "webform-rest-not-installed"]
published_at: "2026-10-22T02:17:09+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T05:00:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96391", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-96391", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Drupal Webform REST: missing authorization lets users browse forbidden data

The Webform REST module for Drupal fails to check authorization on some endpoints, so requests can reach data that should be restricted. An attacker who can send requests to the site can read webform resources they should not see.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Webform REST version with `drush pm:list --filter=webform_rest` on the Drupal site, or look at the `webform_rest` entry in `composer.lock`.
- unknown

## Fix

- Upgrade the Webform REST module to a version newer than `4.2.1`, as the affected range runs up to and including `4.2.1`.
- unknown

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96391
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-96391

## From the sources

Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_