SA-CONTRIB-2026-165: Critical severity drupal/webform vulnerability
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. When Webform is used with JSON:API enabled, submissions may be cached without varying correctly by the authenticated user. If a webform is configured so that authenticated users can view their own submissions, a request to the JSON:API webform submission collection can return a cached response generated for a different user. This can allow an authenticated user to view another user's webform submission data through the JSON:API collection endpoint. This vulnerability is mitigated by the fact that JSON:API must be enabled, the affected webform must expose submissions through JSON:API, and the attacker must have an account with permission to view their own submissions for the affected webform.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/webformto a version that resolves this vulnerability.Fixed in 6.2.12Fixed in 6.3.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites are exposed only when JSON:API is enabled and an affected webform exposes submissions through JSON:API. The webform must also allow authenticated users to view their own submissions.
What does an attacker need to exploit it?
An attacker needs an authenticated account with permission to view their own submissions for the affected webform. They can then request the JSON:API webform submission collection and may receive a cached response generated for another user.
Are default installations affected?
The issue requires specific configuration: JSON:API must be enabled, submissions must be exposed through JSON:API, and authenticated users must be allowed to view their own submissions. The provided information does not establish whether those conditions are enabled by default.
How can administrators identify potentially affected webforms?
Review webforms that expose submission data through JSON:API and check whether authenticated users have permission to view their own submissions. Those webforms are potentially affected when JSON:API is enabled.