CVE-2026-96373: Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168

Published Oct 22, 2026

Updated

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Drupal Webform to a version that resolves this vulnerability.
Patch SA-CONTRIB-2026-168

Event History

Oct 22, 2026

CVE Published

via MITRE·01:21 AM

Data Sourced

via MITRE·01:21 AM

DescriptionWeakness

Frequently Asked Questions

Which Webform versions are affected?

Affected versions are 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1. Version 6.2.13 or 6.3.2 is not listed as affected.

What type of access is bypassed?

The issue is an incorrect authorization flaw that permits forceful browsing. The provided information does not identify the specific Webform resources, roles, or URLs involved.

CVE-2026-96373: Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168

Remediation

Event History

Frequently Asked Questions

Which Webform versions are affected?

What type of access is bypassed?

Company

Resources

Contact

Frequently Asked Questions

Which Webform versions are affected?

What type of access is bypassed?