SA-CONTRIB-2026-171: Critical severity drupal/webform vulnerability
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The Webform Share submodule can expose a webform for embedding on another site. Under certain circumstances, submissions for an Ajax-enabled Webform using Webform Share can bypass anti-spam protections. This vulnerability is mitigated by the fact that Webform Share must be enabled, sharing must be enabled for the affected webform, and the affected webform must rely on compatible Form-API-based anti-spam protections such as Honeypot or Antibot.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/webformto a version that resolves this vulnerability.Fixed in 6.2.12Fixed in 6.3.1 - Configuration
Configure affected Ajax-enabled webforms using Webform Share to rely on a compatible Form-API-based anti-spam protection such as Honeypot or Antibot.
Webform Form-API-based anti-spam protection = Honeypot or Antibot
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Exposure requires the Webform Share submodule to be enabled, sharing to be enabled on the affected webform, and that webform to use Ajax. The form must also rely on compatible Form-API-based anti-spam protections, such as Honeypot or Antibot.
What does an attacker need to exploit it?
An attacker needs access to an affected shared, Ajax-enabled webform. The issue can allow submissions to bypass the form's compatible anti-spam protections.
Are webforms protected if Webform Share is not enabled or sharing is disabled?
The described conditions require Webform Share and sharing for the affected form to be enabled. Forms that do not meet those conditions are not described as affected.
What can be done while waiting to patch?
Disable the Webform Share submodule, disable sharing on affected webforms, or avoid using Ajax on affected shared forms. Review submissions from affected forms for spam that may have bypassed Honeypot, Antibot, or other compatible Form-API-based protections.