DRUPAL-CONTRIB-2026-165: Webform - Less critical - Access bypass - SA-CONTRIB-2026-165

Q: Which deployments are affected?

Drupal Webform versions from 0.0.0 through 6.2.12, and from 6.3.0 through 6.3.1, are affected.

Q: What access does an attacker need?

The listed vector requires network access and low privileges. User interaction is not required, but exploitation is rated high complexity.

Q: What is the potential impact?

The issue can result in low-impact disclosure of sensitive information through web browser cache contents. No integrity or availability impact is listed.

Published Oct 22, 2026

Updated

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

Affected Software

1 affected component

Drupal Webform>=0.0.0<=6.2.12, >=6.3.0<=6.3.1

Event History

Oct 22, 2026

CVE Published

via OSV·01:21 AM

Data Sourced

via OSV·01:21 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Drupal Webform versions from 0.0.0 through 6.2.12, and from 6.3.0 through 6.3.1, are affected.

What access does an attacker need?

The listed vector requires network access and low privileges. User interaction is not required, but exploitation is rated high complexity.

What is the potential impact?

The issue can result in low-impact disclosure of sensitive information through web browser cache contents. No integrity or availability impact is listed.

DRUPAL-CONTRIB-2026-165: Webform - Less critical - Access bypass - SA-CONTRIB-2026-165

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

What is the potential impact?