The vulnerability in the Drupal Webform module is an incorrect authorization flaw that permits forceful browsing. It allows an attacker to bypass normal access checks and retrieve or interact with forms that they should not view or submit. The weakness maps to the CWE-863 family, which is a classic authorization bypass through user‑controlled keys. Depending on the site’s configuration, this can lead to disclosure of sensitive form data or unintended form submissions, compromising confidentiality and potentially integrity of form content.

Drupal Webform is the impacted product. The bug affects all releases from 0.0.0 up to and including 6.2.12, and also the 6.3.0 and 6.3.1 releases. Any Drupal site that installs one of these vulnerable module versions and exposes forms to users is at risk.

The CVSS score of 5.3 is available, indicating a medium level of risk, and the EPSS score is less than 1%, implying a low but nonzero likelihood of exploitation. An attacker could exploit the flaw by constructing URLs that point to restricted form IDs—a typical forceful browsing scenario. Because the flaw is present across many versions, the risk is broad. The vulnerability is not listed in the CISA KEV catalog, showing no confirmed active exploits. Nonetheless, the lack of available mitigation versions warrants proactive action.