Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for Webform REST by Drupal

    CVE-2026-16644 (GCVE-0-2026-16644)

    Vulnerability from nvd – Published: 2026-08-25 22:21 – Updated: 2026-08-25 22:21
    VLAI
    Title
    Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087
    Summary
    Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.
    Severity
    No CVSS data available.
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    References
    Impacted products
    Vendor Product Version
    Drupal Webform REST Affected: 0.0.0 , < 4.1.0 (semver)
    		Create a notification for this product.
    Date Public
    2026-07-22 18:00
    Credits
    Giuseppe (giuseppe87) Dan Chadwick (danchadwick) Giuseppe (giuseppe87) Jacob Rockowitz (jrockowitz) Liam Morland (liam morland) Nelson Alves (nsalves) Anna Kalata (akalata) cilefen (cilefen) Greg Knaddison (greggles) Michael Hess (mlhess) Juraj Nemec (poker10)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/webform_rest",
          "product": "Webform REST",
          "repo": "https://git.drupalcode.org/project/webform_rest",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "4.1.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Giuseppe  (giuseppe87)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Dan Chadwick (danchadwick)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Giuseppe  (giuseppe87)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jacob Rockowitz (jrockowitz)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Liam Morland (liam morland)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nelson Alves (nsalves)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Anna Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "cilefen  (cilefen)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Michael Hess (mlhess)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        }
      ],
      "datePublic": "2026-07-22T18:00:53.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-87",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-87 Forceful Browsing"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:21:51.345Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-087"
        }
      ],
      "title": "Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16644",
    "datePublished": "2026-08-25T22:21:51.345Z",
    "dateReserved": "2026-07-22T17:06:45.880Z",
    "dateUpdated": "2026-08-25T22:21:51.345Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16644 (GCVE-0-2026-16644)

    Vulnerability from cvelistv5 – Published: 2026-08-25 22:21 – Updated: 2026-08-25 22:21
    VLAI
    Title
    Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087
    Summary
    Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.
    Severity
    No CVSS data available.
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    References
    Impacted products
    Vendor Product Version
    Drupal Webform REST Affected: 0.0.0 , < 4.1.0 (semver)
    		Create a notification for this product.
    Date Public
    2026-07-22 18:00
    Credits
    Giuseppe (giuseppe87) Dan Chadwick (danchadwick) Giuseppe (giuseppe87) Jacob Rockowitz (jrockowitz) Liam Morland (liam morland) Nelson Alves (nsalves) Anna Kalata (akalata) cilefen (cilefen) Greg Knaddison (greggles) Michael Hess (mlhess) Juraj Nemec (poker10)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/webform_rest",
          "product": "Webform REST",
          "repo": "https://git.drupalcode.org/project/webform_rest",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "4.1.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Giuseppe  (giuseppe87)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Dan Chadwick (danchadwick)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Giuseppe  (giuseppe87)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jacob Rockowitz (jrockowitz)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Liam Morland (liam morland)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nelson Alves (nsalves)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Anna Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "cilefen  (cilefen)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Michael Hess (mlhess)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        }
      ],
      "datePublic": "2026-07-22T18:00:53.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-87",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-87 Forceful Browsing"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:21:51.345Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-087"
        }
      ],
      "title": "Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16644",
    "datePublished": "2026-08-25T22:21:51.345Z",
    "dateReserved": "2026-07-22T17:06:45.880Z",
    "dateUpdated": "2026-08-25T22:21:51.345Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}