{"id":"DRUPAL-CONTRIB-2026-087","details":"This module enables you to retrieve and submit webform submissions via REST endpoints.\n\nThe module doesn't sufficiently check the parent webform's permissions for creating, viewing and updating permissions.\n\nThis vulnerability is mitigated by the fact that an attacker must already have permissions to use the rest resource.\n\nThis advisory only affects already-unsupported versions 4.0.3 and earlier.","aliases":["CVE-2026-16644"],"modified":"2026-09-10T03:46:18.161588806Z","published":"2026-07-22T18:00:53Z","references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-087"}],"affected":[{"package":{"name":"drupal/webform_rest","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/webform_rest?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0"}],"database_specific":{"constraint":"\u003c4.1.0"}}],"database_specific":{"affected_versions":"\u003c4.1.0","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/webform_rest/DRUPAL-CONTRIB-2026-087.json"}}],"schema_version":"1.9.0","credits":[{"name":"Giuseppe  (giuseppe87)","contact":["https://www.drupal.org/u/giuseppe87"]}]}