---
id: "CVE-2026-96364"
kind: "vulnerability"
aliases: ["CVE-2026-96364"]
title: "Drupal Webform: missing rate limit lets attackers misuse form functionality"
severity: "medium"
cvss: 5.3
epss: 0.00226
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "package", "self-hosted", "webform"]
not_affected_if: ["webform-not-installed"]
published_at: "2026-10-22T02:17:06+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:20:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96364", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-96364", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Drupal Webform: missing rate limit lets attackers misuse form functionality

The Drupal Webform module does not control how often a user can interact with its functionality, so an attacker can repeat actions beyond what was intended. The sources do not say what the specific action is or what data or access results.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Webform version with `drush pm:list --filter=webform` or the Drupal admin Extend page.
- Confirm whether the site is on a version in the affected range (`6.2.12` or earlier, or `6.3.0` to `6.3.1`).

## Fix

- Upgrade Drupal Webform to a version later than `6.3.1` and later than `6.2.12`; the exact fixed version is unknown from the sources.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96364
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-96364

## From the sources

Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_