CVE-2026-84921 in Webform Submissions Delete Plugin
Summary
by MITRE • 10/22/2026
Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified security flaw resides within the Drupal module known as Webform Submissions Delete, specifically affecting version ranges from 0.0.0 up to and including 1.2.0. This vulnerability is classified under the category of Missing Authorization, which fundamentally represents a failure in the application's access control mechanisms to properly verify user permissions before executing sensitive operations. In this specific context, the flaw allows for Forceful Browsing, also commonly referred to as direct object reference manipulation or insecure direct object references. The core technical issue stems from the module not adequately checking whether the authenticated user initiating the deletion request possesses the necessary administrative privileges or ownership rights over the specific webform submission data targeted for removal. Consequently, the application logic proceeds with the destructive action based solely on the presence of a valid session token rather than validating the contextual relationship between the user and the resource being accessed.
From an operational perspective, this vulnerability enables unauthorized actors to delete critical form submissions that they do not own or have permission to manage. Webform modules in Drupal are frequently used to collect sensitive personal information, business data, or confidential communications from users. The ability of any authenticated user, or potentially even unauthenticated users depending on the specific site configuration and session handling, to arbitrarily select and delete these records results in a severe compromise of data integrity. Attackers can exploit this by manipulating request parameters such as submission IDs passed via HTTP GET or POST requests to target arbitrary entries within the database. This lack of authorization checks means that the boundary between different user roles is effectively bypassed, allowing lower-privileged users to perform actions reserved for administrators or specific content owners.
The impact of this vulnerability extends beyond simple data loss. In environments where webform submissions contain personally identifiable information subject to regulations such as GDPR or HIPAA, unauthorized deletion constitutes a significant compliance violation and potential legal liability. Furthermore, the destruction of historical records can disrupt business processes that rely on these submissions for analytics, customer support, or operational decision-making. The ease with which this attack can be executed using standard web tools means it poses an immediate risk to any site running the affected versions without additional mitigating controls. It represents a classic example of how insufficient server-side validation leads to privilege escalation in terms of data manipulation capabilities.
To mitigate this vulnerability, organizations must immediately upgrade the Webform Submissions Delete module to version 1.2.1 or later, where the authorization checks have been properly implemented and validated by the maintainers. For sites that cannot update immediately due to compatibility constraints with other modules, temporary mitigations should be applied at the web server level or through custom code patches. These may include restricting access to the specific endpoints associated with submission deletion based on user roles using Drupal's native permission system or implementing additional middleware checks that verify ownership of the resource before allowing the delete operation to proceed. Regular security audits and penetration testing focused on broken access control patterns are recommended to ensure no similar flaws exist in other parts of the application stack. This incident underscores the critical importance of enforcing strict object-level authorization controls for all data manipulation operations within content management systems.