Live › vulnerability › CVE-2026-96369
Go to dashboardDrupal's Webform module can leave sensitive information in the web browser cache because of incorrectly configured access control levels. An attacker with access to the same browser or a shared cache may read that cached data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Drupal with the Webform module in the affected version ranges, especially where forms collect sensitive data and pages are served with cacheable responses. Sites on versions above 6.2.12 that are not in the 6.3.0 to 6.3.1 range are not affected, and sites without Webform can skip it.
No product ranges from the sources yet.
drush pm:list --filter=webform or the Drupal admin Extend page6.3.1 and later than 6.2.12, as stated in the advisoryEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-96369")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.