Solideogloria

An incorrect authorization issue exists where the module fails to reliably restrict a subset of dynamic routes, which are routes that change based on specific parameters or conditions. This leads to an access bypass that allows forceful browsing.

Incorrectly configured access control security levels allow the use of web browser cache containing sensitive information. The module fails to cache data on a per-user basis, which may allow an attacker with the same permissions to view authentication keys belonging to another user. This issue requires the `dynamic page cache` module to be enabled to be exploitable.

Insufficient access restrictions on the delete form allow forceful browsing, which occurs when a user accesses a page or resource without proper authorization. This issue allows unauthorized users to delete webform submissions in bulk using a specified date range.

The issue is related to an Incorrect Authorization vulnerability in Drupal REST & JSON API Authentication, allowing Forceful Browsing. This can enable a remote attacker to bypass existing security restrictions.