A vulnerability in the Drupal Webform module, called Insufficient Granularity of Access Control, enables forceful browsing of URLs and resources that should be protected. Attackers can exploit the lack of proper authorization checks to retrieve or view form data and configuration settings that are not intended for general users, potentially exposing sensitive information.

Drupal Webform module for Drupal sites, affecting all releases from 0.0.0 up to and including 6.2.12 and from 6.3.0 through 6.3.1. Any Drupal installation that has one of these module versions unintentionally allows unauthorized users to access the module’s protected resources.

The vulnerability can be exploited over the web by crafting requests to endpoints normally guarded by authentication or role checks. With a CVSS score of 5.4 and an EPSS score of <1%, and with no listing in the KEV catalog, the likelihood of widespread exploitation appears low, yet the access bypass condition still poses a moderate risk of confidential data disclosure if an attacker can reach the affected forms or query endpoints.