CVE-2026-16644
Critical · CVSS 9.1- CVSS
- 9.1
- nvd
- EPSS
- 0.31%
- 24th pct
- KEV
- No
- Class
- oss containerizable
- CWE-863
Description
Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.
Affected packages
| Packagist:https://packages.drupal.org/8 | drupal/webform_rest | 0 → 4.1.0 |
References
Status: profiled · ingested 2026-08-28T18:00:49.000Z