CVE-2026-96373: Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168
Published Oct 22, 2026
·Updated
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Affected Software
1 affected component
Drupal Webform>=0.0.0<=6.2.12, >=6.3.0<=6.3.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Drupal Webformto a version that resolves this vulnerability.Patch SA-CONTRIB-2026-168
Event History
Oct 22, 2026
CVE Published
via MITRE·01:21 AM
Data Sourced
via MITRE·01:21 AM
DescriptionWeakness
Data Sourced
via OSV·01:21 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which Webform versions are affected?
Affected versions are 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1. Version 6.2.13 or 6.3.2 is not listed as affected.
2
What type of access is bypassed?
The issue is an incorrect authorization flaw that permits forceful browsing. The provided information does not identify the specific Webform resources, roles, or URLs involved.