CVE-2026-96398: Webform - Less critical - Access bypass - SA-CONTRIB-2026-173

Q: Which Webform versions are affected?

Affected versions are 0.0.0 through 6.2.12, and 6.3.0 through 6.3.1. The provided information does not identify an affected Drupal core version.

Q: What type of access control failure is involved?

The issue is an incorrect authorization vulnerability that allows forceful browsing. This means an attacker may be able to access resources by directly requesting paths or URLs that should be restricted.

Published Oct 22, 2026

Updated

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

Affected Software

1 affected component

Drupal Webform>=0.0.0<=6.2.12, >=6.3.0<=6.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Drupal Webform to a version that resolves this vulnerability.
Patch SA-CONTRIB-2026-173

Event History

Oct 22, 2026

CVE Published

via MITRE·01:21 AM

Data Sourced

via MITRE·01:21 AM

DescriptionWeakness

Frequently Asked Questions

Which Webform versions are affected?

Affected versions are 0.0.0 through 6.2.12, and 6.3.0 through 6.3.1. The provided information does not identify an affected Drupal core version.

What type of access control failure is involved?

The issue is an incorrect authorization vulnerability that allows forceful browsing. This means an attacker may be able to access resources by directly requesting paths or URLs that should be restricted.