Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186

Project: Webform RESTProject machine name: webform_restDate: 2026-September-23Security risk: Less critical 9 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <4.2.1CVE IDs: CVE-2026-96391Description: This module enables you to retrieve and submit webforms via REST.
The module doesn't sufficiently check permission to webform and webform submission entities when retrieving webform elements or fields.Solution: Install the latest version:

• Upgrade to Webform REST 4.2.1. The 4.1.x branch is no longer supported.

Reported By: 

• Lauri (laurii)

Fixed By: 

• Adam Bramley (acbramley)
• Miguel Ferreira (miguelpamferreira)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• cilefen (cilefen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Mohit Aghera (mohit_aghera) provisional member of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team