Drupal Webform EUVD-2026-107832

The description identifies the mechanism only as Incorrect Authorization enabling 'forceful browsing' - an attacker directly accessing a Webform resource via a known or guessed URL that should be access-controlled - but it does not name the exact form, submission view, or endpoint affected, so the precise trigger is not described in the available sources. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required and exploitation works remotely against affected Webform installations (0.0.0-6.2.12 and 6.3.0-6.3.1). The principal limiting factor is impact scope: the flaw yields only low confidentiality exposure (C:L) with no integrity or availability impact, so it enables unauthorized reading of restricted data rather than modification or takeover; exploitation is also bounded to sites running the affected Webform versions on Drupal.

This is a medium-severity information-disclosure issue (CVSS 5.3) whose real-world urgency is moderate, not critical. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates a remotely reachable, low-complexity flaw that needs no privileges or user interaction, but its impact is deliberately narrow - only low confidentiality loss, with no integrity or availability impact, consistent with CWE-863 Incorrect Authorization enabling forceful browsing to resources the user should not reach. The exploitation signals all point the same direction and are mutually consistent: EPSS is very low at 0.20% (9th percentile), the CVE is NOT on the CISA KEV list, and no public exploit is identified in the provided data. The vuln.today decision label is 'this_month' rather than 'act_now' or 'emergency', reinforcing that this warrants scheduled remediation rather than crisis response. No SSVC decision tree (automatable / technical impact) was supplied, so that framework cannot be independently applied. There is no conflict among the signals here - a genuinely reachable but low-impact disclosure bug with low predicted exploitation. Treat it as a real but non-emergency priority: apply the vendor patch within the normal monthly maintenance window.

A remote, unauthenticated attacker directly requests a Webform resource or endpoint (for example by navigating to or guessing a URL) that should have been access-restricted, and the incorrect authorization check fails to block them, disclosing information they should not be able to see. No public exploit code is identified in the provided data, and the limited C:L impact means the attacker gains read-level exposure rather than control of the site. The exact resource and request that trigger the flaw are not described in the available sources.