{"id":"CVE-2026-96356","kind":"vulnerability","aliases":["CVE-2026-96356"],"related":[],"title":"Drupal Webform: incorrect authorization lets users browse restricted pages","description":"Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","summary":"Drupal Webform versions up to 6.2.12 and 6.3.0 through 6.3.1 have an authorization flaw that lets a user reach pages they should not see by forced browsing. The sources give a CVSS score of 5.3 (medium) and no evidence of exploitation in the wild.","severity":"medium","cvss":5.3,"epss":0.0034,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","self-hosted","webform"],"not_affected_if":["fixed-version","webform-not-installed"],"how_to_check":"- Run `composer show drupal/webform` on the Drupal site and compare the installed version with the affected range\n- Check whether any Webform submission or results pages are reachable by users without the matching permission","fix":"- Upgrade drupal/webform to `6.2.13` or later, or to a 6.3 release newer than `6.3.1` (the sources do not name the exact fixed version)","status":"open","published_at":"2026-10-22T02:17:05+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:20:38+00:00","updated_at":"2026-10-25T04:20:38+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:20:38Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade drupal/webform to `6.2.13` or later, or to a 6.3 release newer than `6.3.1` (the sources do not name the exact fixed version)","reach":"internet","title":"Drupal Webform: incorrect authorization lets users browse restricted pages","impact":"medium","summary":"Drupal Webform versions up to 6.2.12 and 6.3.0 through 6.3.1 have an authorization flaw that lets a user reach pages they should not see by forced browsing. The sources give a CVSS score of 5.3 (medium) and no evidence of exploitation in the wild.","category":"package","nicknames":[],"who_cares":["drupal","webform","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Users read Webform pages or submissions they are not allowed to see.","analyst_note":"","how_to_check":"- Run `composer show drupal/webform` on the Drupal site and compare the installed version with the affected range\n- Check whether any Webform submission or results pages are reachable by users without the matching permission","needs_analyst":false,"not_affected_if":["webform-not-installed","fixed-version"],"who_is_affected":"Drupal sites that run the Webform module in the affected version ranges. Sites without Webform, or on a fixed version, are not affected. Exposure depends on which Webform pages are reachable by users who should not see them, which the sources do not detail.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000596,"input_tokens":3328,"output_tokens":527,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-96356':12A,15A '0.0.0':81C '5.3':56B '6.2.12':27B,83C '6.3.0':29B,85C '6.3.1':31B,87C 'affect':77C 'allow':72C 'author':4A,34B,67C 'brows':7A,48B,74C 'cve':10A,13A 'cvss':53B 'drupal':1A,16B,22B,70C 'evid':60B 'exploit':62B 'flaw':35B 'forc':47B,73C 'give':51B 'host':20B 'incorrect':3A,66C 'issu':76C 'let':5A,37B 'medium':57B 'packag':17B 'page':9A,41B 'reach':40B 'restrict':8A 'score':54B 'see':45B 'self':19B 'self-host':18B 'sourc':50B 'user':6A,39B 'version':24B,79C 'vulner':68C 'webform':2A,21B,23B,71C,78C 'wild':65B","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the Webform module in the affected version ranges. Sites without Webform, or on a fixed version, are not affected. Exposure depends on which Webform pages are reachable by users who should not see them, which the sources do not detail.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96356","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96356","severity":null,"published_at":"2026-10-22T02:17:05+00:00","modified_at":"2026-10-22T16:54:17+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96356","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96356","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}