{"field_issue_status":"7","field_project":{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/2854742","id":"2854742","resource":"node","machine_name":"webform_rest"},"field_sa_advisory_id":"186","field_sa_coordinated_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/akalata\u0022 rel=\u0022nofollow\u0022\u003ESwan Kalata (akalata)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/bramdriesen\u0022 rel=\u0022nofollow\u0022\u003EBram Driesen (bramdriesen)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/cilefen\u0022 rel=\u0022nofollow\u0022\u003Ecilefen  (cilefen)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/greggles\u0022 rel=\u0022nofollow\u0022\u003EGreg Knaddison (greggles)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/mohit_aghera\u0022 rel=\u0022nofollow\u0022\u003EMohit Aghera (mohit_aghera)\u003C\/a\u003E provisional member of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/poker10\u0022 rel=\u0022nofollow\u0022\u003EJuraj Nemec (poker10)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/xjm\u0022 rel=\u0022nofollow\u0022\u003EJess  (xjm)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_criticality":"AC:Basic\/A:User\/CI:Some\/II:None\/E:Theoretical\/TD:Uncommon","field_sa_description":{"value":"\u003Cp\u003EThis module enables you to retrieve and submit webforms via REST.\u003C\/p\u003E\n\u003Cp\u003EThe module doesn\u0027t sufficiently check permission to webform and webform submission entities when retrieving webform elements or fields.\u003C\/p\u003E","format":"1"},"field_sa_fixed_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/acbramley\u0022 rel=\u0022nofollow\u0022\u003EAdam Bramley (acbramley)\u003C\/a\u003E\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/miguelpamferreira\u0022 rel=\u0022nofollow\u0022\u003EMiguel Ferreira (miguelpamferreira)\u003C\/a\u003E\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_reported_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/laurii\u0022 rel=\u0022nofollow\u0022\u003ELauri  (laurii)\u003C\/a\u003E\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_solution":{"value":"\u003Cp\u003EInstall the latest version:\u003C\/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EUpgrade to \u003Ca href=\u0022\/project\/webform_rest\/releases\/4.2.1\u0022 rel=\u0022nofollow\u0022\u003EWebform REST 4.2.1\u003C\/a\u003E. The 4.1.x branch is no longer supported.\u003C\/li\u003E\n\u003C\/ul\u003E","format":"1"},"field_sa_type":"Access bypass","field_issue_last_status_change":"1790184199","field_sa_cve":["CVE-2026-96391"],"field_is_psa":"0","field_affected_versions":"\u003C4.2.1","field_fixed_in":[{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3625142","id":"3625142","resource":"node"}],"nid":"3624724","vid":"14500452","is_new":false,"type":"sa","title":"Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186","language":"en","url":"https:\/\/www.drupal.org\/sa-contrib-2026-186","edit_url":"https:\/\/www.drupal.org\/node\/3624724\/edit","status":"1","promote":"0","sticky":"0","created":"1790183981","changed":"1790184199","author":{"uri":"https:\/\/www.drupal.org\/api-d7\/user\/406161","id":"406161","resource":"user"},"comment":"0","comments":[{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16778981","id":16778981,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16779323","id":16779323,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16779326","id":16779326,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16779327","id":16779327,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16779328","id":16779328,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16780365","id":16780365,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16780712","id":16780712,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16780714","id":16780714,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16780790","id":16780790,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16781965","id":16781965,"resource":"comment"}],"comment_count":0,"comment_count_new":false,"body":[],"feeds_item_guid":null,"feeds_item_url":null,"feed_nid":null,"flag_flag_tracker_follow_user":[],"flag_tracker_follower_count":null,"has_new_content":null,"last_comment_timestamp":"1790183981","sa_risk":[9,"Less critical"],"sa_id":"SA-CONTRIB-2026-186"}