PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-96391 Drupal CVE debrief

A Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions from 0.0.0 to 4.2.1. The vulnerability allows attackers to bypass authorization and access sensitive information. Drupal users should assess their exposure and verify their version numbers to ensure they are not vulnerable to this issue. The CVE record and source item provide details on the vulnerability and affected versions, but additional verification is necessary to confirm the scope of the vulnerability.

Vendor
Drupal
Product
Webform REST
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-30
Advisory published
2026-10-22
Advisory updated
2026-10-30

Who should care

Drupal users who have Webform REST installed should assess their exposure and verify their version numbers to ensure they are not vulnerable to this issue. They should also review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, users should monitor for potential forceful browsing attempts and prioritize remediation for affected deployments.

Why it matters

Drupal Webform REST users should assess exposure and verify version numbers due to a Missing Authorization vulnerability allowing Forceful Browsing.

  • Verify version numbers and update to 4.2.1 or later if necessary
  • Assess exposure and prioritize remediation for affected deployments
  • Monitor for potential forceful browsing attempts

Technical summary

The Webform REST module for Drupal has a Missing Authorization vulnerability, which allows for Forceful Browsing. The issue affects versions from 0.0.0 to 4.2.1. This vulnerability could lead to unauthorized access to sensitive information. Drupal users should assess their exposure and verify their version numbers to ensure they are not vulnerable to this issue. The vulnerability can be exploited by attackers to bypass authorization and access sensitive information.

Defensive priority

Drupal Webform REST users should assess exposure and verify version numbers.

Recommended defensive actions

  • Verify Webform REST version numbers and update to 4.2.1 or later if necessary
  • Assess exposure and prioritize remediation for affected deployments
  • Monitor for potential forceful browsing attempts

Evidence notes

The CVE record and source item provide details on the vulnerability and affected versions. However, additional verification is necessary to confirm the scope of the vulnerability and assess exposure. Defenders should verify their Webform REST version numbers and review compensating controls for exposed systems while remediation is scheduled and verified. The vulnerability allows Forceful Browsing, which could lead to unauthorized access to sensitive information. It is essential to note

Sources and references

Verified primary and authoritative sources

  • CVE-2026-96391 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-96391

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-96391 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-96391

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.