CVE-2026-96372: Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167
Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Drupal Webformto a version that resolves this vulnerability.Patch SA-CONTRIB-2026-167
Event History
Frequently Asked Questions
Which Webform installations are affected?
Affected versions are 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1. The provided information does not identify any affected Drupal core versions or configuration-specific conditions.
What kind of attacker interaction does exploitation require?
The issue is described as forceful browsing caused by insufficiently granular access control. The provided information does not state whether an attacker needs authentication, particular permissions, or any other prerequisite.
How can I determine whether my site is affected?
Check the installed Webform module version. A site using a version in either affected range should be treated as affected based on the available information.