Webform and Webform REST Flaws in the September 2026 Drupal Advisory

Two related projects, two advisories

Advisory WID-SEC-2026-3554 covers contributed Drupal projects, and two of them belong to the same family. Webform is a widely installed module for building submission forms, and Webform REST exposes those submissions through a REST interface.
The advisory lists fixed releases for both. Webform is fixed in 6.2.12 and 6.3.1, covering two maintenance branches. Webform REST is fixed in 4.2.1.
Webform installations are common enough that the flaw class deserves attention on its own, because a form module is by design reachable by anonymous visitors.

Why a form module carries risk

A form builder accepts input from anyone who can reach the form. That input is stored in the database and later rendered, exported, or delivered by email. Each of those steps is a place where inadequate handling produces a security consequence.
Rendering stored submission data into an administrative listing is the classic stored scripting path. Delivering it into an export or a template that interprets content adds a second path. The advisory's shared impact sentence covers data manipulation, disclosure, and cross-site scripting, all of which fit a submission-handling module.

The REST layer

Webform REST adds an API surface on top of the stored submissions. An API that authenticates a caller but does not check whether that caller may read the specific submission is a disclosure and escalation risk, because submission records frequently contain personal data.
Sites that expose a Webform REST endpoint to the internet should treat the fixed release as urgent rather than routine.

Affected scope

The advisory covers Webform, Webform REST, Cloud, Project Browser, Commerce Decoupled Checkout, Mermaid Diagram Field, CookieCuttr, REST & JSON API Authentication, Stop administrator login, Tawk.to Live chat application, Editoria11y Accessibility Checker, AI CKEditor, Combined image style, CSS Usage Analyzer, Smart Content and Diba carousel slider. Fixed releases include Webform 6.2.12 and 6.3.1, Webform REST 4.2.1, Cloud 7.0.1, Project Browser 2.0.3 and 2.1.5, Commerce Decoupled Checkout 1.8.0, Mermaid Diagram Field 1.0.9, CookieCuttr 2.0.3, REST & JSON API Authentication 3.2.0, Stop administrator login 1.6, Tawk.to Live chat application 3.0.4, Editoria11y Accessibility Checker 2.2.23 and 3.0.9, AI CKEditor 1.4.3, Combined image style 1.0.7, CSS Usage Analyzer 1.0.2, Smart Content 3.2.1 and Diba carousel slider 3.0.2.
Sites running Webform or Webform REST below the fixed versions are in scope. Sites that run Webform without the REST companion still need the Webform update.

Remediation

Update Webform to 6.2.12 or 6.3.1 according to the branch in use, and Webform REST to 4.2.1. Then review stored submissions for unexpected content that would indicate prior exploitation, and check submission export logs for access from unfamiliar addresses.
Where Webform REST is not required, disable it. Removing a route from the application is more reliable than filtering requests to it.

References

• CERT-BUND advisory WID-SEC-2026-3554, published 23 September 2026, high risk
• CERT-BUND structured advisory record, product version list and referenced Drupal advisories
• ZoomEye exposure query app="Drupal", executed 24 September 2026, exact count 436286