CVE-2026-16644

CriticalCVSS 9.1

Published: 25/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 26/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects versions from 0.0.0 to 4.1.0.

An attacker may access form submission data, potentially compromising information confidentiality.

Update the Webform REST module to a version that includes the security fix.

Original NVD description (English source)

Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.