{"id":"CVE-2026-96364","kind":"vulnerability","aliases":["CVE-2026-96364"],"related":[],"title":"Drupal Webform: missing rate limit lets attackers misuse form functionality","description":"Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","summary":"The Drupal Webform module does not control how often a user can interact with its functionality, so an attacker can repeat actions beyond what was intended. The sources do not say what the specific action is or what data or access results.","severity":"medium","cvss":5.3,"epss":0.00226,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","self-hosted","webform"],"not_affected_if":["webform-not-installed"],"how_to_check":"- Check the installed Webform version with `drush pm:list --filter=webform` or the Drupal admin Extend page.\n- Confirm whether the site is on a version in the affected range (`6.2.12` or earlier, or `6.3.0` to `6.3.1`).","fix":"- Upgrade Drupal Webform to a version later than `6.3.1` and later than `6.2.12`; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-10-22T02:17:06+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:20:38+00:00","updated_at":"2026-10-25T04:20:38+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:20:38Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Drupal Webform to a version later than `6.3.1` and later than `6.2.12`; the exact fixed version is unknown from the sources.","reach":"internet","title":"Drupal Webform: missing rate limit lets attackers misuse form functionality","impact":"low","summary":"The Drupal Webform module does not control how often a user can interact with its functionality, so an attacker can repeat actions beyond what was intended. The sources do not say what the specific action is or what data or access results.","category":"package","nicknames":[],"who_cares":["drupal","webform","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker repeats form actions beyond intended limits; data or impact unknown","analyst_note":"Check the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-96364 and the Drupal security advisory for the fixed version and which Webform action is affected.","how_to_check":"- Check the installed Webform version with `drush pm:list --filter=webform` or the Drupal admin Extend page.\n- Confirm whether the site is on a version in the affected range (`6.2.12` or earlier, or `6.3.0` to `6.3.1`).","needs_analyst":true,"not_affected_if":["webform-not-installed"],"who_is_affected":"Sites running the Drupal Webform module in the listed affected version ranges are exposed. The sources do not say which Webform features or configurations are required to reach the flaw, so teams without Webform installed can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000617,"input_tokens":3338,"output_tokens":567,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-96364':13A,16A '0.0.0':83C '6.2.12':85C '6.3.0':87C '6.3.1':89C 'access':63B 'action':44B,57B 'affect':79C 'allow':74C 'attack':7A,41B 'beyond':45B 'control':29B,66C 'cve':11A,14A 'data':61B 'drupal':1A,17B,24B,72C 'form':9A 'frequenc':69C 'function':10A,38B,75C 'host':21B 'improp':65C 'intend':48B 'interact':35B,68C 'issu':78C 'let':6A 'limit':5A 'miss':3A 'misus':8A,76C 'modul':26B 'often':31B 'packag':18B 'rate':4A 'repeat':43B 'result':64B 'say':53B 'self':20B 'self-host':19B 'sourc':50B 'specif':56B 'user':33B 'version':81C 'vulner':70C 'webform':2A,22B,25B,73C,80C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Webform module in the listed affected version ranges are exposed. The sources do not say which Webform features or configurations are required to reach the flaw, so teams without Webform installed can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96364","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96364","severity":null,"published_at":"2026-10-22T02:17:06+00:00","modified_at":"2026-10-22T16:54:17+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96364","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96364","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}