CVE-2026-16644

Drupal Webform REST versions 0.0.0 to 4.1.0 are susceptible to an Incorrect Authorization vulnerability that enables forceful browsing, potentially allowing unauthorized users to access restricted resources. Organizations using these versions should prioritize remediation to prevent unauthorized data exposure and ensure compliance with security best practices. Immediate attention is recommended for those managing web applications built on Drupal that utilize the Webform REST module.