Webform Submissions Delete CVE-2026-84921

The 'Webform Submissions Delete' Drupal contrib module (versions 0.0.0 through 1.2.0) must be installed and enabled on a Drupal site that holds webform submissions, since this is an add-on module and not Drupal core. Exploitation is via forceful browsing: directly requesting the submission-deletion route whose authorization check is missing. The supplied CVSS vector states PR:N/UI:N (no authentication or user interaction), but the description does not explicitly confirm the access level, so whether an anonymous or merely low-privileged account is required is not established by the available sources. Impact is limited to integrity (deletion of submissions, I:L); there is no confidentiality exposure or availability/denial-of-service effect, which bounds realistic risk below the network-unauthenticated framing.

This is a moderate, low-urgency issue rather than a top priority. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) describes network-reachable, low-complexity exploitation with no privileges or user interaction, but the impact is narrow: integrity-only (I:L) with no confidentiality or availability effect, consistent with unauthorized deletion of webform submissions. All exploitation-pressure signals point low and agree with each other: EPSS is 0.19% (8th percentile), the vulnerability is NOT in CISA KEV, and the CISA SSVC framework reports Exploitation: none, Automatable: no, Technical Impact: partial. The vuln.today decision label is 'this_month,' i.e. routine scheduled patching, not emergency action. One tension to flag: the vendor-supplied vector asserts PR:N (unauthenticated), yet the root cause is a Missing Authorization / forceful-browsing flaw (CWE-862) in a module whose purpose is deleting submissions - such flaws frequently require an authenticated but under-privileged account bypassing a permission check; the available sources do not state the actual access level, so treat PR:N as vendor-asserted but unverified. Net: a real but low-to-moderate integrity issue in a niche Drupal contrib module; patch on a normal cycle.

An attacker (per the vendor vector, without authentication; access level not confirmed by the description) directly requests the module's submission-deletion endpoint that fails to enforce the required permission, deleting webform submissions they should not be able to remove. No public exploit code or PoC reference was supplied for this CVE, and exploitation yields data deletion (integrity impact) only - no data disclosure or service outage.