CVE-2026-16644

Executive Summary

CVE-2026-16644 is an Incorrect Authorization vulnerability in the Drupal Webform REST module that enables Forceful Browsing attacks. The vulnerability affects all versions from 0.0.0 through 4.1.0, allowing unauthenticated or low-privileged attackers to directly access REST endpoints or resources they are not authorized to view. Given the unpatched status (0/4 patch confidence) and the prevalence of Drupal Webform in public-facing web applications, enterprise deployments running affected versions are exposed to unauthorized data disclosure and potential submission manipulation.

Technical Analysis

The vulnerability is classified under CWE-863 (Incorrect Authorization), which indicates that the application performs an access control check but does so incorrectly — either at the wrong point in the request lifecycle, with insufficient authorization context, or against the wrong permission set. In the context of the Drupal Webform REST module, this manifests as a Forceful Browsing flaw: the application fails to enforce authorization policies on certain REST endpoints that expose webform configuration, submissions, or submission-related data.

The attack surface is the Drupal REST API layer, specifically the endpoints registered by the Webform REST sub-module. Under normal operation, Drupal's REST resource authorization delegates to the underlying entity's access handlers (e.g., access('view'), access('update')). An Incorrect Authorization flaw in this module means that one or more REST routes are either:

1. Registered without the proper _access or _permission requirement in the routing YAML
2. Using a custom access callback that returns TRUE incorrectly for certain roles or authentication states
3. Relying on the webform's default submission access but failing to account for per-webform or per-instance permissions

Because the NVD description does not specify which exact endpoint or resource type is affected, the precise technical mechanism (e.g., which route, which permission predicate) remains undetermined from available data. However, the vulnerability class implies that a direct HTTP request — crafted to target a specific REST resource path — will bypass the authorization layer and return data or trigger state changes.

The affected version range (0.0.0 to 4.1.0) spans early development releases through the latest at the time of CNA listing, indicating this is a long-standing flaw present in the module's core REST integration rather than a regression introduced in a specific minor version.

Exploitation Scenarios

Threat actor profile: Low-skill attackers, automated scanning bots, and potentially ransomware operators who seek to harvest sensitive data (PII from form submissions) before or during network intrusion.

Step 1 — Reconnaissance / Target identification: Attackers identify a Drupal instance running the Webform module. Detection vectors include CMS fingerprinting via HTTP response headers (X-Generator: Drupal), site metadata, or probing for known Drupal paths (/jsonapi, /rest/, /webform/). The presence of the Webform REST sub-module may not be externally obvious without deeper enumeration, but attackers using Shodan-style dorks for Drupal installations will locate candidate targets. The attacker then enumerates REST endpoint patterns commonly associated with webform resources.

Step 2 — Triggering the flaw: The attacker sends a crafted HTTP request to a REST endpoint that the Webform REST module exposes — likely a path that maps to webform configuration, form element definitions, or stored submission records. Because the authorization check is incorrect (CWE-863), the request proceeds without proper validation of the requester's permissions. No authentication bypass is necessarily required if the flaw allows any authenticated user (including anonymous-like roles) to access resources; alternatively, the flaw may permit authenticated low-privilege users to access admin-level data.

Step 3 — Payload/execution method: At the vulnerability-class level, the attacker performs a direct GET request to resource endpoints that should be restricted, e.g., requests returning form submission data or webform settings. Depending on the REST module's configuration, the accept header determines the response format (JSON, HAL+JSON, XML). The attacker iterates over resource identifiers (sequential IDs or UUIDs) to enumerate multiple records — a hallmark of Forceful Browsing.

Step 4 — Post-exploitation impact: Successful exploitation yields unauthorized disclosure of webform submission data, which may contain PII (names, emails, addresses), medical information, financial details, or internal business forms. This can lead to data breach notification obligations under GDPR/CCPA. In scenarios where the flawed endpoint also allows PUT/PATCH/DELETE operations, attackers could tamper with form definitions, alter submissions, or delete records — impacting data integrity. In enterprise environments, this data could seed further social engineering or credential-stuffing attacks if submissions include corporate authentication details.

Note: No public PoC or exploit code is available. The attack chain is inferred strictly from the vulnerability class (authorization bypass leading to forceful browsing) and the Drupal ecosystem's known architecture.

Impact Assessment

• Confidentiality impact: Unauthorized read access to webform submissions and form configuration. Given that webforms in Drupal commonly collect personal data from website visitors (contact forms, registrations, surveys), the confidentiality impact is expected to be HIGH.
• Integrity impact: Potential modification of form configuration or submission records if mutating HTTP verbs are also affected by the flawed authorization check. Integrity impact is MODERATE (unconfirmed from available data).
• Availability impact: Low — the flaw itself does not suggest denial-of-service potential.
• CVSS reference: N/A — no CVSS vector has been assigned. However, based on the vulnerability class and Drupal's deployment in internet-facing web properties, the effective severity rating should be treated as HIGH (7.0–8.9) until the vendor assigns a formal score.
• Affected systems: All versions of the Drupal Webform REST module from 0.0.0 to 4.1.0. Organizations running Drupal 8, Drupal 9, or Drupal 10 — where webform is a commonly installed contrib module — are in scope. The blast radius extends to any public-facing web application using Drupal forms for data collection.
• Compliance impact: Exfiltration of PII triggers mandatory breach reporting; failure to patch an unpatched known-vulnerable component may be viewed as negligence in post-incident review.

Detection Guidance

The following detection content targets the HTTP request patterns and server-side anomalies consistent with forceful browsing against Drupal Webform REST endpoints.

Sigma Rule

title: Drupal Webform REST - Forceful Browsing Attempt (CVE-2026-16644)
status: experimental
description: Detects repeated unauthorized access attempts to Drupal Webform REST endpoints,
  indicative of forceful browsing exploitation for CVE-2026-16644.
author: valterisit.com Threat Intel Team
date: 2026/01/01
logsource:
  category: webserver
  product: apache
  service: access_log
detection:
  selection_webform_routes:
    cs-method:
      - 'GET'
      - 'POST'
      - 'PUT'
      - 'PATCH'
      - 'DELETE'
    cs-uri-query|contains:
      - '/webform_rest'
      - '/webform/'
      - '/rest'
    cs-uri-stem|contains:
      - '_format=json'
      - '?_format=hal_json'
      - '?_format=xml'
  selection_high_frequency:
    cs-uri-stem|contains:
      - '/submission'
      - '/config'
      - '/element'
    cs-uri-query|contains: 'webform'
  filter_normal_browsing:
    cs-username|exists: true
  condition: selection_webform_routes and selection_high_frequency and not filter_normal_browsing
  timeframe: 5m
level: medium
falsepositives:
  - Legitimate monitoring tools accessing webform configuration
  - Content migration scripts using valid credentials
  - Authorized cross-site REST consumers
fields:
  - clientip
  - cs-uri-stem
  - cs-uri-query
  - cs-method
  - cs-username
tags:
  - attack.t1190
  - cve.2026-16644
  - cwe.863

YARA Rule

rule drupal_webform_rest_forceful_browsing_cve_2026_16644 {
    meta:
        author = "valtersit.com Threat Intel Team"
        description = "Detects suspicious access patterns targeting Drupal Webform REST endpoints"
        reference = "CVE-2026-16644"
        cwe = "CWE-863"
        date = "2026-01-01"
        severity = "high"
    strings:
        $rest_path = "/webform_rest" ascii nocase
        $rest_path2 = "/webform/" ascii nocase
        $json_format = "?_format=json" ascii nocase
        $hal_format = "?_format=hal_json" ascii nocase
        $submission_ref = "submission" ascii nocase
        $config_ref = "config" ascii nocase
        $uuid_pattern = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/ ascii
    condition:
        filesize < 10KB and
        any of ($rest_path*) and
        (any of ($json_format*) or any of ($hal_format*)) and
        (any of ($submission_ref*) or any of ($config_ref*)) and
        #uuid_pattern > 3
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Drupal Webform REST Forceful Browsing Attempt (CVE-2026-16644)"; flow:to_server,established; content:"GET"; http_method; content:"/webform_rest"; http_uri; nocase; content:"_format="; http_uri; nocase; content:!"Authorization"; http_header; pcre:"/submission|config|element/i"; threshold:type both, track by_src, count 10, seconds 300; classtype:attempted-recon; sid:202616644; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where event.category == "web" and event.action == "request"
      and http.request.method in ("GET","POST","PUT","PATCH","DELETE")
      and http.request.uri contains ("/webform_rest", "/webform/")
      and http.request.uri contains ("submission", "config", "element")
      and not user.id != null ]
  [ network where event.category == "web" and event.action == "request"
      and http.request.method in ("GET","POST","PUT","PATCH","DELETE")
      and http.request.uri contains ("/webform_rest", "/webform/")
      and http.request.uri contains ("submission", "config", "element")
      and not user.id != null ]

Splunk SPL Query

index=web sourcetype=apache:access uri_path IN ("/webform_rest*", "/webform/*")
| where like(uri_query, "%_format=%")
| stats count by src_ip, uri_path, method
| where count > 10
| eval risk_score = count * 2
| sort - count
| table _time, src_ip, method, uri_path, uri_query, count, risk_score
| rename src_ip as "Source IP", uri_path as "Webform REST Path", method as "HTTP Method"

Wazuh OSSEC Rule

<group name="drupal,">
  <rule id="202644" level="10" frequency="10" timeframe="300">
    <if_sid>31250</if_sid>
    <match>/webform_rest|/webform/</match>
    <regex>_format=(json|hal_json|xml)</regex>
    <description>Drupal Webform REST: High-frequency requests to webform endpoints without authentication - possible CVE-2026-16644 forceful browsing</description>
    <group>attack.t1190,cve_2026_16644,cwe_863</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor patch, hotfix, or backport is currently available from any tracked source. Do not assume the module's manufacturer will release a fix; plan for extended exposure.

1) Immediate mitigations:

• Disable the Webform REST sub-module if REST access to webforms is not a hard business requirement: drush pm-uninstall webform_rest.
• If the module must remain enabled, restrict network-level access to the REST endpoints via WAF rules that block unauthenticated requests to URIs containing webform_rest, format=json, and submission or config strings.
• Implement IP allowlisting so that only trusted management networks or known API consumers can reach the affected endpoints.
• For enterprise Drupal deployments, use a reverse proxy (nginx/varnish) to intercept requests matching the affected URI patterns and require an additional header (e.g., X-Origin-Auth: verify) that the application otherwise ignores.
• Audit web server access logs to determine if the module has already been probed; assume compromise if access logs show enumeration patterns.

2) Patch / upgrade steps:

• Monitor the Drupal security advisory feed (https://www.drupal.org/security) and the Webform module's issue queue for a patched release. Since no patch is available, the only guaranteed remediation is to remove the vulnerable components.
• If available in the future, upgrade to Webform REST version > 4.1.0 once released. Until then, treat any deployment as vulnerable and mitigate via configuration.
• Evaluate whether Drupal's core REST/JSON:API modules can substitute for the Webform REST module's functionality with proper access controls.

3) Long-term hardening:

• Adopt the principle of least privilege for REST API access: use Drupal core's rest.resource configuration to require explicit permissions (restful get webform_submission) and verify the _permission lines in the module's routing YAML.
• Conduct a targeted code review of the installed Webform REST module version: inspect webform_rest.routing.yml and any custom access callbacks for missing _permission or _access keys.
• Implement continuous scanning: run weekly authenticated scans of Drupal REST endpoints to verify that unauthenticated requests are denied with HTTP 403.
• Register the CVE in SIEM alerting and threat intel platforms to trigger immediate alerts when any new exploit or PoC becomes public.
• Establish an incident response playbook for CWE-863 authorization flaws, including log preservation, data exposure assessment, and notification procedures given the likely PII impact.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-16644
2. Drupal Webform Module Project Page: https://www.drupal.org/project/webform
3. CWE-863 Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
4. Drupal Security Advisories: https://www.drupal.org/security
5. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat intelligence notes: No known exploit-in-the-wild campaigns, no public exploit code, no CISA KEV inclusion, and no EPSS score at the time of writing. The vulnerability's unpatched status across the entire 0.0.0–4.1.0 version range, combined with the ubiquity of the Webform module in Drupal deployments, suggests opportunistic threat actors may begin targeting the affected REST endpoints once automated scanning tools integrate the CVE signature. Monitor Drupal security advisories and the Webform module's GitHub issue tracker for patch announcements.