CVE-2026-16644

Awaiting Analysis Awaiting Analysis - Queue

Incorrect Authorization in Drupal Webform REST Allows Forceful Browsing

Publication date: 2026-08-25

Last updated on: 2026-08-28

Assigner: Drupal.org

Description

Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-28

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-16644

EUVD

EUVD-2026-66203

Affected Vendors & Products

Vendor	Product	Version / Range
drupal	webform_rest	From 0.0.0 (inc) to 4.1.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This is an Incorrect Authorization vulnerability in Drupal Webform REST that allows Forceful Browsing. It affects Webform REST versions from 0.0.0 to 4.1.0, meaning attackers could bypass intended access controls and access restricted resources.

Detection Guidance

To detect this vulnerability, check the installed version of Drupal Webform REST. If the version is between 0.0.0 and 4.1.0, the system is vulnerable. Use commands like 'drush pm-list | grep webform_rest' or inspect the module version in the Drupal admin panel.

Impact Analysis

If you use a vulnerable version of Drupal Webform REST, attackers could exploit this to access sensitive data or perform unauthorized actions through forceful browsing. This could lead to data breaches or unauthorized modifications.

Compliance Impact

This vulnerability allows unauthorized access to sensitive data through forceful browsing, which could lead to violations of data protection regulations like GDPR or HIPAA if personal or health information is exposed.

Mitigation Strategies

Update Webform REST to version 4.1.0 or later to address the Incorrect Authorization vulnerability. Remove or disable the Webform REST module if not needed.

Hi! I’m here to help you understand CVE-2026-16644. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70