CVE-2026-96391

Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.

EPSS

0.2% chance of exploitation in the next 30 days; higher than 7% of CVEs (scores of 2026-10-25)

CWE

CWE-862

Published

2026-10-22

Modified

2026-10-22

Record from

the NVD, synced 2026-10-22

References

• https://www.drupal.org/sa-contrib-2026-186

Check your stackJSON