PatchClock

PHP security digest · 23 Sep 2026

This module enables you to retrieve and submit webforms via REST. The module doesn't sufficiently check permission to webform and webform submission entities w...

Unrated CVE-2026-96391

Package
drupal/webform_rest
Fixed in
4.2.1
Published
Wed 23 Sep 2026, 18:19 LisbonUpdated Mon 26 Oct 2026, 02:25 Lisbon

In plain words

The module does not sufficiently check permissions when retrieving webform elements or fields via REST. This can allow an attacker to access webform or submission information without the required permission.

Am I affected?

Look for drupal/webform_rest and its version in composer.lock. The advisory lists 4.2.1 as fixed but gives no affected version range. Check whether your project uses the module to retrieve webform elements or fields via REST, as this is the operation described.

What to do

Check which version you have, then update to a fixed release for your branch (4.2.1):

composer show drupal/webform_rest | grep versions
composer update drupal/webform_rest

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

This module enables you to retrieve and submit webforms via REST.

The module doesn't sufficiently check permission to webform and webform submission entities when retrieving webform elements or fields.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.