Live › vulnerability › CVE-2026-96356
Go to dashboardDrupal Webform versions up to 6.2.12 and 6.3.0 through 6.3.1 have an authorization flaw that lets a user reach pages they should not see by forced browsing. The sources give a CVSS score of 5.3 (medium) and no evidence of exploitation in the wild.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Drupal sites that run the Webform module in the affected version ranges. Sites without Webform, or on a fixed version, are not affected. Exposure depends on which Webform pages are reachable by users who should not see them, which the sources do not detail.
No product ranges from the sources yet.
composer show drupal/webform on the Drupal site and compare the installed version with the affected range6.2.13 or later, or to a 6.3 release newer than 6.3.1 (the sources do not name the exact fixed version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-96356")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.