Insufficient granularity of access control in the Webform module allows forceful browsing. The module does not sufficiently restrict access to configure Remote HTTP Operations handlers, which could allow a user with permission to edit a webform to configure a remote HTTP operation.