Description

Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-25T23:16:57.200Z",
  "pubdate": "2026-08-25T23:16:57.200Z",
  "executiveSummary": "The Webform REST module for Drupal contains an Incorrect Authorization vulnerability, identified as a critical flaw that facilitates Forceful Browsing.\nThis vulnerability stems from improper access control enforcement within the REST resource implementation, allowing unauthorized users to access data or functional endpoints that should be restricted.\nThe issue affects all versions of Webform REST from 0.0.0 through 4.1.0.\nThe primary impact is the unauthorized exposure of sensitive form submission data or internal system configurations, depending on the scope of the exposed REST endpoints.\nAn attacker can exploit this vulnerability without requiring authentication by manipulating HTTP requests to access sensitive resources directly, bypassing established Drupal security policies.\nThe risk implication is significant as it potentially compromises the confidentiality and integrity of webform data, which often includes personally identifiable information (PII) or sensitive user submissions.\nOrganizations utilizing affected versions of the Webform REST module are exposed to data exfiltration risks and should prioritize immediate security review or version remediation.",
  "technicalDetails": "The vulnerability resides within the REST resource handler logic of the Webform REST module. The root cause is the failure to properly integrate or validate Drupal's Access Checkers (or 'access callback' mechanisms) within the REST plugin definitions or the underlying request handler.\nWhen a REST resource is requested, the module fails to verify if the current user session possesses the appropriate 'permission' or 'entity access' required to interact with the specific resource, resulting in an Incorrect Authorization state.\nThe attack flow begins with an attacker identifying the REST endpoints exposed by the Webform REST module. By observing the API schema or utilizing automated directory/endpoint brute-forcing, an attacker discovers that these endpoints do not enforce authorization checks.\nThe attacker executes a 'Forceful Browsing' attack by crafting direct HTTP GET, POST, or other method requests to these REST endpoints. Because the module lacks the necessary access verification logic, the system processes the request as if the user is authorized, returning sensitive data or executing unintended actions.\nThe vulnerability is inherent to the module's architecture in versions 0.0.0 through 4.1.0, where the access control layer is bypassed due to incomplete implementation of Drupal's routing and access system. This effectively lowers the privilege requirement for sensitive data retrieval to zero, as no legitimate authentication context is validated by the endpoint.\nNetwork exposure is defined by the availability of the REST API interface. Since Drupal REST services are often exposed via public web interfaces, this vulnerability is remotely exploitable without authentication.\nThe post-exploitation impact includes the systematic harvesting of sensitive webform submissions, potential modification of form configuration metadata, and the bypass of workflow restrictions enforced by the core Webform module. The lack of granular authorization logic ensures that even private or restricted submission data is served in cleartext via the REST response if the attacker knows or guesses the resource identifier (e.g., submission ID).\nThis vulnerability highlights a failure in secure coding practices regarding API endpoint protection, specifically the omission of strict 'permission' callbacks that are standard in Drupal 8/9/10 RESTful services."
}