SA-CONTRIB-2026-167: Critical severity drupal/webform vulnerability

Published Sep 23, 2026
·
Updated

The Webform module enables site builders to create forms and collect submissions. The module does not sufficiently restrict access to configure Remote HTTP Operations handlers. This vulnerability could allow a user with permission to edit a webform to configure a remote HTTP operation. The update adds the Administer webform remote post URLs permission. Review this permission and ensure it is granted only to trusted roles. The vulnerability is mitigated by the fact that an attacker must have a role with permission to edit a webform.

Credit

Pierre Rudloff (prudloff)(the Drupal Security Team), Wesley Giles (seraphdev)

Affected Software

1 affected componentFixes available
drupal/webform<6.2.12, <6.3.11
6.2.126.3.11

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade drupal/webform to a version that resolves this vulnerability.

    Fixed in 6.2.12Fixed in 6.3.11
  2. Configuration

    Review the Administer webform remote post URLs permission and ensure it is granted only to trusted roles.

    Webform module Administer webform remote post URLs permission = Granted only to trusted roles

Event History

Sep 23, 2026
Advisory Published
via Drupal·12:00 AM
Data Sourced
via Drupal·12:00 AM
DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

1

Who is exposed to this issue?

Sites are exposed if untrusted users have permission to edit a webform. The issue is mitigated when only trusted roles can edit webforms.

2

What access does an attacker need to exploit it?

An attacker needs a role with permission to edit a webform. They could then configure a Remote HTTP Operations handler.

3

What should be reviewed after applying the update?

Review the new Administer webform remote post URLs permission. Grant it only to trusted roles.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203