SA-CONTRIB-2026-133: Critical severity drupal/webform_submissions_delete vulnerability
This module enables you to delete Webform submissions in bulk using a specified date range. The module doesn't sufficiently restrict access to the delete form. A separate PHP fatal error issue may prevent exploitation in practice on Drupal 10+.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/webform_submissions_deleteto a version that resolves this vulnerability.Fixed in 8.x-1.2
Event History
Frequently Asked Questions
Who is exposed to unauthorized bulk deletion of submissions?
Sites using the drupal/webform_submissions_delete module are affected because access to its date-range deletion form is not sufficiently restricted. The issue concerns Webform submissions that can be selected for bulk deletion by date range.
Does Drupal 10 or later prevent this issue from being exploited?
A separate PHP fatal error may prevent exploitation in practice on Drupal 10 and later. This is not described as an access-control fix, so deployments should not rely on the fatal error as protection.