EUVD-2026-66203
GHSA-6fwm-vrgx-rjw7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Faulty authorization on network-reachable REST endpoints needs no privileges or interaction (AV:N/AC:L/PR:N/UI:N); forceful browsing exposes and can alter submission data (C:H/I:H), with no availability impact (A:N).
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
3DescriptionCVE.org
Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.
AnalysisAI
Authorization bypass in the Drupal Webform REST contrib module (all versions from 0.0.0 up to and including 4.1.0) lets remote unauthenticated attackers reach REST resources they should not be able to access through forceful browsing. Because the module fails to properly enforce access checks on its endpoints, an attacker can read and potentially manipulate webform data or submissions guarded only by obscurity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Drupal site has the Webform REST contrib module installed and enabled at a vulnerable version (0.0.0 through 4.1.0) with its REST resources exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mixed but lean toward genuine concern for exposed instances. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: upgrade Webform REST to the fixed release referenced in Drupal SA-CONTRIB-2026-087 (https://www.drupal.org/sa-contrib-2026-087) - a version later than 4.1.0; the exact fixed version number is not stated in the provided data, so confirm it against the advisory before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Drupal instances using Webform REST module versions 4.1.0 or earlier and assess which webforms contain sensitive data; disable or restrict unauthenticated access to REST endpoints as an interim control if disabling is not feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today