CVE-2026-16644

An incorrect authorization flaw in the Drupal Webform REST contrib module (which exposes webform submissions via REST endpoints) allows forceful browsing . The module does not sufficiently validate the parent webform's permissions for create, view, and update operations. The advisory classifies t...