Webform Rest
Monthly
Authorization bypass in the Drupal Webform REST contrib module (all versions from 0.0.0 up to and including 4.1.0) lets remote unauthenticated attackers reach REST resources they should not be able to access through forceful browsing. Because the module fails to properly enforce access checks on its endpoints, an attacker can read and potentially manipulate webform data or submissions guarded only by obscurity. No public exploit is identified at time of analysis and EPSS risk is low (0.18%, 7th percentile), but the CVSS 9.1 rating and SSVC 'total technical impact' make this a high-severity data-exposure issue.
Authenticated low-privilege users on Drupal sites running Webform REST 0.0.0 through 4.2.1 can bypass intended authorization and use forceful browsing to reach Webform REST resources they should not access, with confidentiality-only impact. The flaw is CWE-862 missing authorization, rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N); EPSS is 0.20% at the 9th percentile and no public exploit has been identified at time of analysis, making this a moderate this-month priority rather than an emergency.
Authorization bypass in the Drupal Webform REST contrib module (all versions from 0.0.0 up to and including 4.1.0) lets remote unauthenticated attackers reach REST resources they should not be able to access through forceful browsing. Because the module fails to properly enforce access checks on its endpoints, an attacker can read and potentially manipulate webform data or submissions guarded only by obscurity. No public exploit is identified at time of analysis and EPSS risk is low (0.18%, 7th percentile), but the CVSS 9.1 rating and SSVC 'total technical impact' make this a high-severity data-exposure issue.
Authenticated low-privilege users on Drupal sites running Webform REST 0.0.0 through 4.2.1 can bypass intended authorization and use forceful browsing to reach Webform REST resources they should not access, with confidentiality-only impact. The flaw is CWE-862 missing authorization, rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N); EPSS is 0.20% at the 9th percentile and no public exploit has been identified at time of analysis, making this a moderate this-month priority rather than an emergency.