CVE-2026-96356: Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174

Q: Which Webform versions are affected?

Affected versions are 0.0.0 through 6.2.12, and 6.3.0 through 6.3.1. The provided information does not identify unaffected fixed versions.

Q: What kind of access control failure is involved?

The issue is an incorrect authorization vulnerability that allows forceful browsing, meaning an attacker may access resources by directly requesting paths or endpoints that should be restricted.

Published Oct 22, 2026

Updated

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

Affected Software

1 affected component

Drupal Webform>=0.0.0<=6.2.12, >=6.3.0<=6.3.1

Event History

Oct 22, 2026

CVE Published

via MITRE·01:21 AM

Data Sourced

via MITRE·01:21 AM

DescriptionWeakness

Frequently Asked Questions

Which Webform versions are affected?

Affected versions are 0.0.0 through 6.2.12, and 6.3.0 through 6.3.1. The provided information does not identify unaffected fixed versions.

What kind of access control failure is involved?

The issue is an incorrect authorization vulnerability that allows forceful browsing, meaning an attacker may access resources by directly requesting paths or endpoints that should be restricted.