CVE-2026-84921

Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0...

CVE-2026-84921 Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133

Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0...

EUVD-2026-107866

Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0...

CVE-2026-84921

The Webform Submissions Delete module for Drupal, affecting versions 0.0.0 through 1.2.0 , contains a Missing Authorization vulnerability. The root cause is that the module does not sufficiently restrict access to the delete form, allowing for Forceful Browsing . An unauthorized user can exploit ...

Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133

This module enables you to delete Webform submissions in bulk using a specified date range. The module doesn't sufficiently restrict access to the delete form. A separate PHP fatal error issue may prevent exploitation in practice on Drupal 10+...

PT-2026-84897

Name of the Vulnerable Software and Affected Versions Webform Submissions Delete versions 0.0.0 through 1.2.0 Description Insufficient access restrictions on the delete form allow forceful browsing, which occurs when a user accesses a page or resource without proper authorization. This issue allo...