SA-CONTRIB-2026-167: Critical severity drupal/webform vulnerability
The Webform module enables site builders to create forms and collect submissions. The module does not sufficiently restrict access to configure Remote HTTP Operations handlers. This vulnerability could allow a user with permission to edit a webform to configure a remote HTTP operation. The update adds the Administer webform remote post URLs permission. Review this permission and ensure it is granted only to trusted roles. The vulnerability is mitigated by the fact that an attacker must have a role with permission to edit a webform.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/webformto a version that resolves this vulnerability.Fixed in 6.2.12Fixed in 6.3.11 - Configuration
Review the Administer webform remote post URLs permission and ensure it is granted only to trusted roles.
Webform module Administer webform remote post URLs permission = Granted only to trusted roles
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites are exposed if untrusted users have permission to edit a webform. The issue is mitigated when only trusted roles can edit webforms.
What access does an attacker need to exploit it?
An attacker needs a role with permission to edit a webform. They could then configure a Remote HTTP Operations handler.
What should be reviewed after applying the update?
Review the new Administer webform remote post URLs permission. Grant it only to trusted roles.