DRUPAL-CONTRIB-2026-168: Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168

Q: Which Webform installations are affected?

Affected versions are 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1. The provided data does not identify affected Drupal core versions or configuration-specific conditions.

Q: What access does an attacker need to exploit this issue?

The vector indicates network reachability, but exploitation requires high privileges and no user interaction. The issue is described as forceful browsing caused by incorrect authorization.

Q: What could an attacker gain through successful exploitation?

Successful exploitation may result in limited impact to confidentiality and integrity. No availability impact is indicated.

Published Oct 22, 2026

Updated

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

Affected Software

1 affected component

Drupal Webform>=0.0.0<=6.2.12, >=6.3.0<=6.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SA-CONTRIB-2026-168

Event History

Oct 22, 2026

CVE Published

via OSV·01:21 AM

Data Sourced

via OSV·01:21 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Webform installations are affected?

Affected versions are 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1. The provided data does not identify affected Drupal core versions or configuration-specific conditions.

What access does an attacker need to exploit this issue?

The vector indicates network reachability, but exploitation requires high privileges and no user interaction. The issue is described as forceful browsing caused by incorrect authorization.

What could an attacker gain through successful exploitation?

Successful exploitation may result in limited impact to confidentiality and integrity. No availability impact is indicated.

DRUPAL-CONTRIB-2026-168: Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Webform installations are affected?

What access does an attacker need to exploit this issue?

What could an attacker gain through successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which Webform installations are affected?

What access does an attacker need to exploit this issue?

What could an attacker gain through successful exploitation?