Live › vulnerability › CVE-2026-96367
Go to dashboardDrupal Webform module versions up to 6.2.12 and 6.3.0 through 6.3.1 have a privilege definition flaw that allows stored cross-site scripting. A user with the affected permission can store script in a form that runs in another user's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Drupal sites running the Webform module in the affected version ranges. Sites without Webform installed, or running a fixed release, are not exposed. The sources do not say which roles hold the vulnerable permission in default configuration.
No product ranges from the sources yet.
drush pm:list --filter=webform or the Extend page in Drupal admin.6.3.1 or 6.2.12, as listed in the Drupal security advisory (unknown exact fixed version in sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-96367")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.