{"id":"CVE-2026-96366","kind":"vulnerability","aliases":["CVE-2026-96366"],"related":[],"title":"Drupal Webform: incorrect authorization lets users browse forbidden pages","description":"Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","summary":"Drupal's Webform module has an authorization flaw that lets a user reach resources by forced browsing (guessing or typing URLs) instead of through the intended access path. An attacker can read form content or submissions they should not see.","severity":"medium","cvss":5.3,"epss":0.0034,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","self-hosted","webform"],"not_affected_if":["fixed-version","not-using-webform"],"how_to_check":"- Check the installed Webform version with `drush pm:list --filter=webform` or the Drupal admin Extend page\n- Compare against the affected range: 6.2.12 and earlier, and 6.3.0 to 6.3.1","fix":"- Upgrade Webform to a version after 6.3.1 or after 6.2.12, per the Drupal security advisory (exact fixed version: unknown)","status":"open","published_at":"2026-10-22T02:17:06+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:20:36+00:00","updated_at":"2026-10-25T04:20:36+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:20:36Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Webform to a version after 6.3.1 or after 6.2.12, per the Drupal security advisory (exact fixed version: unknown)","reach":"internet","title":"Drupal Webform: incorrect authorization lets users browse forbidden pages","impact":"medium","summary":"Drupal's Webform module has an authorization flaw that lets a user reach resources by forced browsing (guessing or typing URLs) instead of through the intended access path. An attacker can read form content or submissions they should not see.","category":"package","nicknames":[],"who_cares":["drupal","webform","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Unauthorized users read form data or submissions they should not access.","analyst_note":"Confirm the fixed Webform version and whether anonymous access is needed, using the Drupal security advisory for CVE-2026-96366.","how_to_check":"- Check the installed Webform version with `drush pm:list --filter=webform` or the Drupal admin Extend page\n- Compare against the affected range: 6.2.12 and earlier, and 6.3.0 to 6.3.1","needs_analyst":true,"not_affected_if":["not-using-webform","fixed-version"],"who_is_affected":"Sites running the Drupal Webform module in the affected version ranges. Sites without Webform, or on versions outside the listed ranges, are not affected. Whether anonymous visitors can exploit it depends on the form access settings, which the sources do not say.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000609,"input_tokens":3328,"output_tokens":553,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-96366':12A,15A '0.0.0':77C '6.2.12':79C '6.3.0':81C '6.3.1':83C 'access':48B 'affect':73C 'allow':68C 'attack':51B 'author':4A,28B,63C 'brows':7A,38B,70C 'content':55B 'cve':10A,13A 'drupal':1A,16B,22B,66C 'flaw':29B 'forbidden':8A 'forc':37B,69C 'form':54B 'guess':39B 'host':20B 'incorrect':3A,62C 'instead':43B 'intend':47B 'issu':72C 'let':5A,31B 'modul':25B 'packag':17B 'page':9A 'path':49B 'reach':34B 'read':53B 'resourc':35B 'see':61B 'self':19B 'self-host':18B 'submiss':57B 'type':41B 'url':42B 'user':6A,33B 'version':75C 'vulner':64C 'webform':2A,21B,24B,67C,74C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Webform module in the affected version ranges. Sites without Webform, or on versions outside the listed ranges, are not affected. Whether anonymous visitors can exploit it depends on the form access settings, which the sources do not say.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96366","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96366","severity":null,"published_at":"2026-10-22T02:17:06+00:00","modified_at":"2026-10-22T16:54:17+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96366","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96366","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}