CVE-2026-96367: Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162

Q: Which Webform releases are affected?

Affected releases are 0.0.0 through 6.2.12, and 6.3.0 through 6.3.1. The provided data does not identify a fixed release.

Q: What type of impact does this issue have?

This is a stored cross-site scripting vulnerability in Drupal Webform, categorized as a Privilege Defined With Unsafe Actions issue.

Published Oct 22, 2026

Updated

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

Affected Software

1 affected component

Drupal Webform>=0.0.0<=6.2.12, >=6.3.0<=6.3.1

Event History

Oct 22, 2026

CVE Published

via MITRE·01:21 AM

Data Sourced

via MITRE·01:21 AM

DescriptionWeakness

Frequently Asked Questions

Which Webform releases are affected?

Affected releases are 0.0.0 through 6.2.12, and 6.3.0 through 6.3.1. The provided data does not identify a fixed release.

What type of impact does this issue have?

This is a stored cross-site scripting vulnerability in Drupal Webform, categorized as a Privilege Defined With Unsafe Actions issue.