CVE-2026-96391
Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186
Drupal Webform RESTApplications & CMS
CVSS
NoneNot scoredExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 4.2.1Webform RESTCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.
Text from CVE List
Affected versions 1
- Webform RESTaffected: 0.0.0 before 4.2.1CVE List