Drupal Webform REST is vulnerable to an incorrect authorization flaw that permits forceful browsing. An attacker can craft URLs to access endpoints that should be restricted, potentially exposing sensitive form data or internal state. The weakness is an access control issue as identified by CWE-863, meaning the system fails to enforce the proper restrictions on who may view or manipulate resources.

The affected component is the Webform REST module used within Drupal. Versions from the initial release through 4.1.0 are impacted. No other Drupal modules are listed as affected, and the vendor information is Drupal's contribution package for Webform REST.

The vulnerability’s severity is high, as indicated by a CVSS score of 9.1, and the EPSS score is low (< 1%). However, because it allows an attacker to investigate resources via REST endpoints, the risk remains significant if the module is exposed to the internet. The system can be compromised without requiring elevated privileges, making it a low‑cost, high‑impact scenario. The fact that it is not listed in CISA’s KEV catalog does not diminish its danger; it remains publicly documented and could be exploited by automated scanners. Attackers would likely access it over HTTP(S) to the built‑in REST service, making the attack vector remote and requiring only network connectivity to the application.