Using Drupal 7.81, CiviCRM 5.36.1 with webform intergration.
I have created a webform that pre fills the contact name. This link is sent to anonymous users from CiviMail. Using the tokens, CiviMail generates a URL containing the cid1 and the checksum. Testing this, it seems I can change the cid1 to another contact ID and see the details pre filled. I thought that the checksum prevents this?
I have also tried generating a checksum from the Contact Checksum Utilities extension, but I get the same behaviour.
The webform is set to block unknown users and anonymous users are not permissioned in drupal to see CiviCRM data. Is there another setting I am potentially missing?