CVE-2026-96366: Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169
Published Oct 22, 2026
·Updated
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Event History
Oct 22, 2026
CVE Published
via MITRE·01:21 AM
Data Sourced
via MITRE·01:21 AM
DescriptionWeakness
Frequently Asked Questions
1
Which Webform installations are affected?
Affected versions are 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1. Version 6.2.13 is not listed as affected, and neither are versions later than 6.3.1.
2
What type of access is needed to exploit this issue?
The issue is described as an incorrect authorization flaw that permits forceful browsing. The provided information does not specify whether authentication, a particular role, or other prerequisites are required.