The Drupal Webform REST module is vulnerable to an authorization flaw that permits unauthenticated attackers to bypass access controls and potentially compromise sensitive data.

This vulnerability, classified as CWE-863, involves an incorrect authorization implementation that allows unauthenticated remote attackers to perform forceful browsing. The flaw exists because the module fails to properly validate permissions before granting access to REST endpoints.

The vulnerability carries a CVSS score of 9.1, indicating a critical risk to data confidentiality and integrity. Successful exploitation allows unauthorized users to access or modify data within the Webform REST module, which may lead to significant privacy breaches, regulatory non-compliance, and unauthorized exposure of organizational information.

Immediate Action: Organizations should update the Webform REST module to version 4.1.0 or the latest available release provided by the Drupal security advisory. If an update is not immediately feasible, consider disabling the module entirely until a patch can be applied.

Proactive Monitoring: Security teams should review Drupal access logs for suspicious requests targeting REST API endpoints or unusual patterns of navigation that suggest forced browsing activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to restrict unauthorized access to REST API paths and monitor for anomalous request headers or parameters often associated with exploitation attempts.

Public Exploit Available: Unknown

Given the critical severity and the potential for unauthenticated access to sensitive data, organizations must prioritize the remediation of this vulnerability. Administrators should verify their current version of the Webform REST module and apply the necessary updates immediately to prevent potential exploitation.