The vulnerability is an Improper Control of Interaction Frequency flaw that allows attackers to misuse Webform functionality, effectively bypassing intended access controls. This flaw can enable malicious users to submit data or interact with the webform at a rate or manner not normally permitted, potentially leading to unauthorized data handling or escalation of privileges within the Drupal site. The weakness is classified as CWE‑799, indicating improper handling of unsecured access patterns that lead to exploitable abuse of features.

Drupal Webform modules from version 0.0.0 through 6.2.12 and from 6.3.0 to 6.3.1 are affected. All installations of these versions are susceptible until an update to a later release is applied.

The CVSS score of 5.3 indicates a medium severity vulnerability, and the EPSS score of <1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed large‑scale exploitation cases yet. However, since the flaw allows unrestricted interaction with webform features, the potential impact can be significant for sites that rely on these modules for critical data collection.