—
DRUPAL-CONTRIB-2026-087
Details
This module enables you to retrieve and submit webform submissions via REST endpoints.
The module doesn't sufficiently check the parent webform's permissions for creating, viewing and updating permissions.
This vulnerability is mitigated by the fact that an attacker must already have permissions to use the rest resource.
This advisory only affects already-unsupported versions 4.0.3 and earlier.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist:https://packages.drupal.org/8 / drupal/webform_rest
Introduced in:
0 Fixed in: 4.0.3 Upgrade drupal/webform_rest to 4.0.3 or newer (ecosystem packagist:https://packages.drupal.org/8).