This vulnerability is an incorrect authorization check in Drupal Webform that permits forceful browsing of form data. An attacker can craft a URL that bypasses access control, enabling them to view or submit data that should be restricted. The resulting unauthorized access may expose sensitive information and provide insight into application structure. This weakness is identified as an improper authorization control (CWE-863).

Drupal Webform module versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1 are affected. All installations running these versions are vulnerable until the fix is applied.

Based on the description, it is inferred that an attacker can remotely deliver a crafted HTTP request to the vulnerable Webform endpoint, bypassing the intended access checks. This is a remote attack that relies on the presence of the module and does not require elevated privileges on the host. The EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog, indicating no known exploitation activity to date. The CVSS score of 3.3 indicates low severity; therefore the risk level is low; however, the exposure of form content warrants remediation.