DRUPAL-CONTRIB-2026-174: Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174

Q: Which Webform installations are affected?

Affected versions are 0.0.0 through 6.2.12, and 6.3.0 through 6.3.1. The provided information does not identify any affected Drupal core versions or configuration prerequisites.

Q: What access does an attacker need to exploit this issue?

The vulnerability is remotely exploitable with low attack complexity and requires no privileges or user interaction. It is an authorization bypass via forceful browsing.

Q: What is the expected impact if exploitation succeeds?

The stated impact is limited to confidentiality, with low confidentiality impact and no integrity or availability impact indicated.

Published Oct 22, 2026

Updated

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

Affected Software

1 affected component

Drupal Webform>=0.0.0<=6.2.12, >=6.3.0<=6.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Drupal Webform to a version that resolves this vulnerability.
Patch SA-CONTRIB-2026-174

Event History

Oct 22, 2026

CVE Published

via OSV·01:21 AM

Data Sourced

via OSV·01:21 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Webform installations are affected?

Affected versions are 0.0.0 through 6.2.12, and 6.3.0 through 6.3.1. The provided information does not identify any affected Drupal core versions or configuration prerequisites.

What access does an attacker need to exploit this issue?

The vulnerability is remotely exploitable with low attack complexity and requires no privileges or user interaction. It is an authorization bypass via forceful browsing.

What is the expected impact if exploitation succeeds?

The stated impact is limited to confidentiality, with low confidentiality impact and no integrity or availability impact indicated.

DRUPAL-CONTRIB-2026-174: Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Webform installations are affected?

What access does an attacker need to exploit this issue?

What is the expected impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which Webform installations are affected?

What access does an attacker need to exploit this issue?

What is the expected impact if exploitation succeeds?