Webform Submissions Delete
Monthly
Missing authorization in Drupal's Webform Submissions Delete contributed module, versions 0.0.0 through 1.2.0, allows remote attackers to delete stored webform submissions by directly requesting the deletion route, affecting integrity only. The module must be installed and enabled on a site holding submissions; the CVSS vector is AV:N/AC:L/PR:N/UI:N with I:L, though the supplied sources do not explicitly confirm whether anonymous or low-privileged access suffices. No public exploit has been identified at time of analysis, EPSS is 0.19% (8th percentile), a vendor patch is available, and the priority is this_month rather than emergency.
Missing authorization in Drupal's Webform Submissions Delete contributed module, versions 0.0.0 through 1.2.0, allows remote attackers to delete stored webform submissions by directly requesting the deletion route, affecting integrity only. The module must be installed and enabled on a site holding submissions; the CVSS vector is AV:N/AC:L/PR:N/UI:N with I:L, though the supplied sources do not explicitly confirm whether anonymous or low-privileged access suffices. No public exploit has been identified at time of analysis, EPSS is 0.19% (8th percentile), a vendor patch is available, and the priority is this_month rather than emergency.