Drupal Webform EUVD-2026-107827

Requires a target Drupal site running the Webform contributed module at a vulnerable version (any release below 6.2.12, or 6.3.0 through 6.3.1 below 6.3.1). The CVSS vector is AV:N/AC:L/PR:N/UI:N, so no authentication or user interaction is required to reach the flaw against a default install, and exploitation is to request a resource that Webform fails to authorize. Limiting factors: impact is confined to limited confidentiality (C:L; no write or denial-of-service), the site must actually run an affected Webform version, and the specific resource or feature exposed via forceful browsing is not described in the available sources - so the sensitivity of what an attacker can read cannot be confirmed from the input.

This is a moderate-severity information-exposure issue, not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3) indicates a network-reachable, unauthenticated, low-complexity flaw whose only impact is a limited loss of confidentiality (C:L) with no integrity or availability impact - consistent with CWE-863 Incorrect Authorization enabling 'forceful browsing' (directly requesting resources that should be access-controlled). The exploitation signals are modest and mutually consistent: EPSS is 0.20% (9th percentile), the issue is NOT on CISA KEV, and no verified public exploit code is present in the input - only vendor/aggregator advisories (Drupal SA-contrib-2026-174, VulDB, EUVD). The vuln.today decision label is 'this_month' (routine patch cadence), not act_now or emergency. There is no SSVC exploitation/automatable/technical-impact breakdown in the input to cross-reference, so prioritization rests on CVSS + EPSS + KEV, which all point the same way: a legitimate issue to remediate on a normal patch cycle rather than a drop-everything priority. The low EPSS and absence of KEV together suggest no observed widespread exploitation. One caveat: the CVSS claims PR:N (unauthenticated), but the description does not specify which Webform resources become accessible, so the practical sensitivity of the exposed data cannot be confirmed from the available sources.

A remote, unauthenticated user directly requests a Webform-managed URL or resource that should be protected by access controls, and due to the incorrect authorization check gains access to data they should not see (low confidentiality impact). No public exploit code is identified in the input, and the specific endpoint or feature that is forcefully browsed is not described in the available sources.