SA-CONTRIB-2026-174: Critical severity drupal/webform vulnerability
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Webform did not sufficiently guard user-specific access rules against a malformed saved configuration. Under certain site-specific conditions, an access rule intended to grant submission access only to selected user accounts could also grant access to anonymous users. This vulnerability is mitigated by the fact that the bypass depends on malformed saved access-rule configuration.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/webformto a version that resolves this vulnerability.Fixed in 6.2.12Fixed in 6.3.1
Event History
Frequently Asked Questions
What conditions are required for anonymous users to gain submission access?
The site must have a malformed saved access-rule configuration, and the affected rule must be intended to grant submission access only to selected user accounts. The issue occurs only under site-specific conditions involving that configuration.
Are sites using ordinary user-specific submission access rules necessarily affected?
No. The advisory states that exploitation depends on malformed saved access-rule configuration, so the presence of user-specific access rules alone does not establish exposure.
How can administrators assess whether they are exposed?
Review saved Webform access-rule configurations that restrict submission access to selected user accounts, and identify malformed configurations. Verify whether anonymous users can access submissions where those rules are expected to limit access to specific accounts.