CVE-2026-16644: Drupal Webform Rest

Critical severity, CVSS 9.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.

Affected products

• Drupal Webform Rest: from 0.0.0, before 4.1.0 (fixed in 4.1.0)

Published 2026-08-25. Last modified 2026-08-28.