SA-CONTRIB-2026-173: Critical severity drupal/webform vulnerability
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module did not sufficiently restrict access to certain submission view modes. Under certain conditions, a user who can view a submission could access a more permissive view mode and see fields that would otherwise be restricted. This vulnerability is mitigated by the fact that an attacker must already have access to view the affected submission.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/webformto a version that resolves this vulnerability.Fixed in 6.2.12Fixed in 6.3.1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Sites using the Webform module may be exposed where submission view modes are configured with different field-level visibility. The issue affects users who already have permission to view an affected submission.
What does an attacker need to exploit it?
An attacker must already be able to view the affected submission. They could then access a more permissive submission view mode and see fields that would otherwise be restricted.
How can I assess whether sensitive data may have been exposed?
Review Webform submission view modes and identify cases where one view mode exposes fields that are restricted in another. Focus on submissions accessible to users who should not be able to see those additional fields.