Auth bypass in Drupal Webform Rest

CVE-2026-16644

Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.

Vulnerability class: Broken Access Control

Affected products

Weakness classification (CWE)

References