{"id":"CVE-2026-96369","kind":"vulnerability","aliases":["CVE-2026-96369"],"related":[],"title":"Drupal Webform: sensitive data cached in browser exposes submissions to others","description":"Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","summary":"Drupal's Webform module can leave sensitive information in the web browser cache because of incorrectly configured access control levels. An attacker with access to the same browser or a shared cache may read that cached data.","severity":"low","cvss":3.1,"epss":0.0024,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","self-hosted","webform"],"not_affected_if":["patched-version","webform-not-installed"],"how_to_check":"- Check the installed Webform version with `drush pm:list --filter=webform` or the Drupal admin Extend page\n- Compare the version against the affected range: 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1","fix":"- Upgrade Drupal Webform to a version later than `6.3.1` and later than `6.2.12`, as stated in the advisory\n- unknown for the exact patched release number","status":"open","published_at":"2026-10-22T02:17:07+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:47:24+00:00","updated_at":"2026-10-25T04:47:24+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:47:24Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Drupal Webform to a version later than `6.3.1` and later than `6.2.12`, as stated in the advisory\n- unknown for the exact patched release number","reach":"unknown","title":"Drupal Webform: sensitive data cached in browser exposes submissions to others","impact":"low","summary":"Drupal's Webform module can leave sensitive information in the web browser cache because of incorrectly configured access control levels. An attacker with access to the same browser or a shared cache may read that cached data.","category":"package","nicknames":[],"who_cares":["drupal","webform","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Sensitive form data readable from browser cache by other users","analyst_note":"Check the NVD entry and Drupal security advisory for the exact configuration that triggers caching and the patched release numbers.","how_to_check":"- Check the installed Webform version with `drush pm:list --filter=webform` or the Drupal admin Extend page\n- Compare the version against the affected range: 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1","needs_analyst":true,"not_affected_if":["webform-not-installed","patched-version"],"who_is_affected":"Sites running Drupal with the Webform module in the affected version ranges, especially where forms collect sensitive data and pages are served with cacheable responses. Sites on versions above 6.2.12 that are not in the 6.3.0 to 6.3.1 range are not affected, and sites without Webform can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000621,"input_tokens":3364,"output_tokens":570,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-96369':14A,17A '0.0.0':87C '6.2.12':89C '6.3.0':91C '6.3.1':93C 'access':41B,47B,77C 'affect':83C 'allow':73C 'attack':45B 'browser':7A,35B,51B,64C 'cach':5A,36B,55B,59B,65C 'configur':40B,76C 'contain':66C 'control':42B,78C 'cve':12A,15A 'data':4A,60B 'drupal':1A,18B,24B,71C 'exploit':74C 'expos':8A 'host':22B 'incorrect':39B,75C 'inform':31B,68C 'issu':82C 'leav':29B 'level':43B,80C 'may':56B 'modul':27B 'other':11A 'packag':19B 'read':57B 'secur':79C 'self':21B 'self-host':20B 'sensit':3A,30B,67C 'share':54B 'submiss':9A 'use':61C 'version':85C 'vulner':69C 'web':34B,63C 'webform':2A,23B,26B,72C,84C","nicknames":[],"mitigations":[],"who_affected":"Sites running Drupal with the Webform module in the affected version ranges, especially where forms collect sensitive data and pages are served with cacheable responses. Sites on versions above 6.2.12 that are not in the 6.3.0 to 6.3.1 range are not affected, and sites without Webform can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96369","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96369","severity":null,"published_at":"2026-10-22T02:17:07+00:00","modified_at":"2026-10-22T16:54:17+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96369","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96369","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}