Description
Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.
Published: 2026-10-22
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized deletion of Drupal Webform submissions
Action: Immediate patch
AI Analysis

Impact

The vulnerability is a missing authorization flaw that permits an attacker to delete Webform submissions without proper authentication. This flaw is an access control issue that undermines the integrity of user‑generated content and can cause loss of critical data such as survey responses or complaints.

Affected Systems

The issue affects the Drupal Webform Submissions Delete module for all versions from 0.0.0 through 1.2.0. Sites that rely on these module versions are vulnerable and should verify their installation version.

Risk and Exploitability

The flaw can be exploited by sending HTTP requests to the deletion endpoint; no authentication is required. The EPSS score is < 1%, and the vulnerability is not listed in the KEV catalog. The CVSS score is 5.3, indicating moderate risk. The missing authorization allows unauthenticated deletion, which represents a moderate risk for environments that depend on submission data integrity.

Generated by OpenCVE AI on October 23, 2026 at 01:48 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Drupal Webform Submissions Delete to version 1.2.1 or later, which contains the authorization fix.
  • Ensure that only users with explicit delete permissions can use the deletion functionality, removing any delete rights from anonymous or unauthenticated roles.
  • Configure Drupal's permission system or role‑based access controls so that only administrators or designated staff can delete submissions.
  • After applying the patch, audit logs for any unauthorized deletions and verify that all removal endpoints are properly protected.

Generated by OpenCVE AI on October 23, 2026 at 01:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://www.drupal.org/sa-contrib-2026-133 cve-icon cve-icon
History

Thu, 22 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
First Time appeared Drupal
Drupal webform Submissions Delete
Vendors & Products Drupal
Drupal webform Submissions Delete

Thu, 22 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.
Title Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133
Weaknesses CWE-862
References

Subscriptions

Drupal Webform Submissions Delete
cve-icon MITRE

Status: PUBLISHED

Assigner: drupal

Published:

Updated: 2026-10-22T17:17:59.733Z

Reserved: 2026-09-02T15:44:19.097Z

Link: CVE-2026-84921

cve-icon Vulnrichment

Updated: 2026-10-22T17:17:53.419Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-22T02:17:02.667

Modified: 2026-10-22T18:17:30.817

Link: CVE-2026-84921

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T02:00:16Z

Weaknesses