The flaw is an incorrect authorization in the Drupal Webform module that permits a server‑side request forgery (SSRF). Based on the nature of SSRF, it is inferred that an attacker could trigger the Drupal web server to issue arbitrary HTTP requests to any host, potentially exposing internal services or leaking sensitive data. The associated weakness is identified as CWE‑863, illustrating a failure to enforce proper authorization controls when processing form requests.

Drupal Webform versions from 0.0.0 through 6.2.12 and from 6.3.0 to 6.3.1 are affected. Any Drupal site that has these Webform module versions installed is potentially vulnerable.

The EPSS score of <1% and the lack of KEV listing suggest that the likelihood of exploitation is low, though the actual risk remains dependent on form exposure. With a CVSS score of 5.4, this SSRF flaw is considered moderate, but can still enable an attacker to coerce the web server into arbitrary requests if the form is publicly reachable. The attack vector is likely web‑based, requiring only access to the vulnerable form and no special credentials.