The vulnerability is a missing authorization control in the Drupal Webform REST module that permits attackers to perform forceful browsing. By sending crafted requests to any REST endpoint exposed by the module, an unauthenticated user can access content that should be restricted. This weakness arises from inadequate access checks at the API layer and is classified as CWE‑862. Only read operations may be exposed, which can lead to leakage of confidential form data, credential exposure, or other privacy breaches.

Drupal Webform REST module version 0.0.0 through 4.2.1 are affected. The vulnerability applies to any Drupal site that installs this module in that version range, regardless of other modules or configurations.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of <1% indicates a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is an attacker who can reach the Drupal instance’s REST API endpoints. The missing authorization control allows forceful browsing of any webform REST endpoint, enabling an unauthenticated user to read protected content. Since the weakness does not require privileged access or code execution, it may simply result in accidental dissemination of confidential form data or other privacy breaches.