{"id":"CVE-2026-96363","kind":"vulnerability","aliases":["CVE-2026-96363"],"related":[],"title":"Drupal Webform: privilege misconfiguration lets users plant stored XSS","description":"Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","summary":"Drupal Webform versions up to 6.2.12 and 6.3.0 through 6.3.1 have a permission flaw that allows stored cross-site scripting. An attacker with a low-privilege role can store script in form content that runs in other users' browsers.","severity":"medium","cvss":null,"epss":0.00193,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","self-hosted","webform"],"not_affected_if":["patched-version","webform-not-installed"],"how_to_check":"- Check the installed Webform version with `drush pm:list --filter=webform` or the Extend page in the Drupal admin.\n- Review which roles hold Webform element or markup permissions on the Permissions page.","fix":"- Upgrade the Drupal Webform module to a release newer than `6.3.1` (the sources list `6.2.12` and `6.3.1` as affected; the fixed version is unknown).\n- Remove Webform permissions from untrusted roles until patched.","status":"open","published_at":"2026-10-22T02:17:06+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T05:00:34+00:00","updated_at":"2026-10-25T05:00:34+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:00:34Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Drupal Webform module to a release newer than `6.3.1` (the sources list `6.2.12` and `6.3.1` as affected; the fixed version is unknown).\n- Remove Webform permissions from untrusted roles until patched.","reach":"internet","title":"Drupal Webform: privilege misconfiguration lets users plant stored XSS","impact":"medium","summary":"Drupal Webform versions up to 6.2.12 and 6.3.0 through 6.3.1 have a permission flaw that allows stored cross-site scripting. An attacker with a low-privilege role can store script in form content that runs in other users' browsers.","category":"package","nicknames":[],"who_cares":["drupal","webform","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker script runs in other users' browsers, stealing sessions","analyst_note":"Find the fixed Webform version and the exact permission involved in the Drupal security advisory for CVE-2026-96363.","how_to_check":"- Check the installed Webform version with `drush pm:list --filter=webform` or the Extend page in the Drupal admin.\n- Review which roles hold Webform element or markup permissions on the Permissions page.","needs_analyst":true,"not_affected_if":["webform-not-installed","patched-version"],"who_is_affected":"Sites running the Drupal Webform module in the affected version ranges, where users without full administrative rights can create or edit forms or submission content. Sites not using Webform, or running a patched release, can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00062,"input_tokens":3330,"output_tokens":573,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-96363':12A,15A '0.0.0':81C '6.2.12':27B,83C '6.3.0':29B,85C '6.3.1':31B,87C 'action':67C 'affect':77C 'allow':37B,72C 'attack':44B 'browser':62B 'content':56B 'cross':40B 'cross-sit':39B 'cve':10A,13A 'defin':64C 'drupal':1A,16B,22B,70C 'flaw':35B 'form':55B 'host':20B 'issu':76C 'let':5A 'low':48B 'low-privileg':47B 'misconfigur':4A 'packag':17B 'permiss':34B 'plant':7A 'privileg':3A,49B,63C 'role':50B 'run':58B 'script':42B,53B 'self':19B 'self-host':18B 'site':41B 'store':8A,38B,52B,73C 'unsaf':66C 'user':6A,61B 'version':24B,79C 'vulner':68C 'webform':2A,21B,23B,71C,78C 'xss':9A,74C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Webform module in the affected version ranges, where users without full administrative rights can create or edit forms or submission content. Sites not using Webform, or running a patched release, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96363","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96363","severity":null,"published_at":"2026-10-22T02:17:06+00:00","modified_at":"2026-10-22T16:21:29+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96363","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96363","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}