CVE-2026-16644: Drupal Webform REST Auth Bypass Vulnerability

CVE-2026-16644 Overview

CVE-2026-16644 is an Incorrect Authorization vulnerability [CWE-863] in the Drupal Webform REST module. The flaw allows unauthenticated attackers to perform forceful browsing against REST endpoints exposed by the module. Affected versions range from 0.0.0 up to and including 4.1.0. Because the module exposes webform data through REST APIs, missing or incorrect authorization checks let remote actors read and modify data that should require authenticated access.

Critical Impact
Remote, unauthenticated attackers can access and alter webform submission data exposed through the Drupal Webform REST module, breaching confidentiality and integrity of collected form data.

Affected Products

Drupal Webform REST module versions 0.0.0 through 4.1.0
Drupal sites that expose Webform submissions through the module's REST endpoints
Any Drupal deployment with the Webform REST contributed module enabled

Discovery Timeline

2026-08-25 - CVE-2026-16644 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-16644

Vulnerability Analysis

The Webform REST module extends Drupal's Webform module with REST resource endpoints for retrieving and submitting webform data. The vulnerability stems from incorrect authorization logic on those endpoints. Requests that should be gated behind authenticated roles or explicit permissions are served without adequate access verification.

An attacker with network access to the Drupal site can enumerate and request Webform REST resources directly. Because the checks are incorrect rather than missing entirely, standard Drupal permission auditing may not surface the exposure without targeted testing of the REST paths. The impact covers both read and write operations, which aligns with the confidentiality and integrity impact reflected in the CVSS vector.

The issue is classified under CWE-863: Incorrect Authorization. Exploitation requires no authentication, no privileges, and no user interaction, and can be performed over the network.

Root Cause

The root cause is an authorization decision in the Webform REST resource plugins that fails to correctly enforce the caller's permissions against the requested operation. The endpoint accepts the request as authorized when it should reject it, resulting in forceful browsing to protected resources.

Attack Vector

Attackers reach the vulnerability over the network by issuing HTTP requests to the Webform REST endpoints exposed by the site. No credentials or interactive session are required. Attackers can enumerate webform identifiers and submission IDs, then request or manipulate submission data through the affected REST resources.

No public exploit code has been published for CVE-2026-16644 at the time of writing. Technical details are described in the Drupal Security Advisory.

Detection Methods for CVE-2026-16644

Indicators of Compromise

Unauthenticated HTTP requests to Webform REST paths such as /webform_rest/* returning 200 OK with submission payloads
Access log entries showing enumeration of numeric webform or submission identifiers from a single source
Unexpected POST, PATCH, or DELETE requests to Webform REST endpoints from anonymous sessions
Spikes in outbound data volume from the Drupal application tied to Webform REST responses

Detection Strategies

Audit Drupal permissions and route access requirements for every REST resource registered by the Webform REST module.
Replay representative REST requests as an anonymous user in a staging environment and confirm the server returns 401 or 403.
Correlate web server access logs with Drupal watchdog entries to identify successful anonymous access to Webform data.

Monitoring Recommendations

Forward Apache, Nginx, and Drupal watchdog logs to a central analytics platform and alert on anonymous access to Webform REST routes.
Monitor for sequential ID enumeration patterns against /webform_rest/ paths.
Track error-to-success ratios on REST endpoints; a sudden drop in 4xx responses can indicate a successful bypass.

How to Mitigate CVE-2026-16644

Immediate Actions Required

Upgrade the Webform REST module to a fixed release above 4.1.0 as published in the Drupal Security Advisory.
Inventory all Drupal sites for the Webform REST module and record their installed versions.
Restrict network exposure of Webform REST endpoints to trusted clients until the module is patched.

Patch Information

Refer to the Drupal Security Advisory SA-CONTRIB-2026-087 for the fixed version and upgrade instructions. Apply the patched release of the Webform REST module and clear Drupal caches to ensure updated route access definitions are loaded.

Workarounds

Disable the Webform REST module if REST access to webforms is not required for business operations.
Place the Drupal site behind a web application firewall rule that blocks anonymous requests to /webform_rest/* paths.
Restrict the access content and Webform-related permissions granted to the anonymous role until patching is complete.

bash

# Example: block anonymous access to Webform REST paths at the reverse proxy
location ~ ^/webform_rest/ {
    if ($http_authorization = "") {
        return 403;
    }
    proxy_pass http://drupal_backend;
}