External risk intelligence

Drupal Webform REST Forceful Browsing Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-16644

The vulnerability exists in a Drupal Webform REST module. REST API endpoints are commonly deployed as internet-facing services or public-facing application interfaces to facilitate data exchange, making this type of component frequently reachable from the public internet in standard web application deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in the Drupal Webform REST module allows unauthorized access to data by bypassing access controls. This could potentially expose sensitive information if the affected module is in use. The main concern is confirming if your organization utilizes this specific module and is therefore exposed.

Unauthorized data access is possible.
It impacts a common web integration tool.
Verify if this module is in use.

Attack Path

How an attacker could exploit the issue

An attacker could leverage an incorrect authorization flaw in the Drupal Webform REST module to gain unauthorized access to data. This vulnerability is reachable over the network, meaning an attacker could initiate the attack from outside the target environment without needing any prior access or authentication. Successful exploitation could allow an attacker to view or modify sensitive information.

Entry condition: No authentication or prior access needed.
Trigger point: Accessing specific Webform REST endpoints.
Resulting risk: Unauthorized viewing or modification of data.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Drupal's Webform REST module could allow an unauthenticated attacker to bypass authorization controls. When supported by the advisory, this could lead to unauthorized access to webform submissions or related data via the REST API, potentially exposing sensitive information that users submit through webforms.

Webform submissions and related data.
Forceful browsing via REST API.
Exposure of user-submitted data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Drupal Webform REST module requires immediate attention from teams responsible for Drupal application security and infrastructure. The first practical step is to identify all instances of the affected Webform REST module within your Drupal environments, determine their exposure and criticality, and then assign ownership for remediation. The technical leaders and security teams should then coordinate with the accountable application or platform owners to plan and execute the necessary updates during the next available maintenance window or to implement compensating controls if immediate patching is not feasible.

Application or Platform Owners
Verify reachability and business criticality.
Plan and execute remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Drupal Webform REST module?

The Webform REST module is a Drupal extension that provides an API for interacting with webform data. It allows external systems to submit, retrieve, or manage form submissions programmatically. Because it serves as a bridge for data exchange, it is often installed on websites that need to integrate webform information with other applications or services.

What does CWE-863 mean for CVE-2026-16644?

CWE-863 refers to an Incorrect Authorization weakness. In the context of CVE-2026-16644, this means the software fails to properly verify if a user has permission to perform an action. Instead of enforcing security checks, the module mistakenly allows requests to proceed, which can lead to unauthorized access to sensitive webform data that should have been protected.

How is this vulnerability triggered?

An attacker triggers this flaw by accessing specific REST API endpoints exposed by the module. No prior authentication or account access is required, meaning an attacker does not need to log in to exploit it. Note that simply having the module installed is not enough; the vulnerability specifically manifests when an attacker targets these vulnerable API paths to bypass authorization.

Is my site at risk?

Halo Surface Signal indicates that because REST API endpoints are frequently deployed as internet-facing services to facilitate data exchange, this component is often reachable from the public internet. If your Drupal site has this module enabled and exposes these API endpoints to external traffic, it is highly likely to be reachable by an unauthorized actor.

What steps should I take if I use this module?

Start by auditing your Drupal environments to confirm if the Webform REST module is installed and active. Once you have an inventory, coordinate with your application or platform owners to assess the business impact of the affected webforms. Plan to apply updates or implement compensating controls to restrict access to the API endpoints until the security patch is fully deployed.

References

www.drupal.org/sa-contrib-2026-087

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.