CVE-2026-96391 in Webform REST
Summary
by MITRE • 10/22/2026
Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified security flaw resides within the Drupal Webform REST module, specifically affecting version ranges from 0.0.0 up through and including 4.2.1. This vulnerability is classified as a missing authorization issue that enables forceful browsing, allowing unauthorized actors to access sensitive endpoints or data structures intended for authenticated users with specific privileges. In modern web application architectures utilizing Representational State Transfer principles, REST APIs often expose various resources via HTTP methods such as GET, POST, PUT, and DELETE. The core technical flaw lies in the absence of robust access control checks at the API endpoint level within the Webform module. When a request is made to interact with form data or submission endpoints, the system fails to adequately verify whether the requesting user possesses the necessary permissions to view, modify, or delete that specific resource. This oversight means that any individual who can authenticate to the Drupal site, regardless of their role or privilege level, may potentially traverse and manipulate webform submissions intended for administrators or other privileged roles.
From a technical perspective, this vulnerability aligns with CWE-284, which describes Improper Access Control, and more specifically relates to CWE-639 regarding Authorization Bypass through User-Controlled Key if the attack involves manipulating identifiers within REST requests. The operational impact of such a flaw is significant for organizations relying on Drupal for content management and data collection via webforms. Attackers can exploit this weakness to extract personally identifiable information, confidential business data, or other sensitive submissions stored in the database. Beyond simple data exfiltration, the ability to force browse these endpoints may allow attackers to enumerate existing forms, discover submission patterns, or even inject malicious payloads if write operations are also unprotected by proper authorization checks. This undermines the integrity and confidentiality of the application's data layer, potentially leading to regulatory compliance violations depending on the nature of the exposed data.
The exploitation vector typically involves crafting HTTP requests with valid authentication tokens but without the requisite administrative privileges. By systematically probing different REST endpoints associated with webform submissions, an attacker can identify which resources are accessible despite lacking proper role-based access control validation. This behavior is consistent with ATT&CK technique T1078, Valid Accounts, where attackers leverage legitimate credentials to gain unauthorized access to systems or data. The lack of granular permission checks means that the principle of least privilege is not enforced at the API layer, allowing lateral movement within the application's functional scope once initial authentication is achieved.
To mitigate this vulnerability, immediate action should be taken by upgrading the Drupal Webform REST module to a version later than 4.2.1 where these authorization controls have been corrected. Administrators must ensure that all dependencies are updated and that the patching process does not introduce compatibility issues with other modules in their stack. In environments where an upgrade is temporarily unfeasible, implementing additional security layers such as Web Application Firewalls can help detect and block anomalous REST API traffic patterns indicative of forceful browsing attempts. Furthermore, developers should conduct a thorough review of custom code interacting with the Webform REST endpoints to ensure that any bespoke integrations also enforce strict authorization checks before processing requests. Regular security audits and penetration testing focused on API access controls are recommended to identify similar gaps in other parts of the application architecture.