---
id: "CVE-2026-96369"
kind: "vulnerability"
aliases: ["CVE-2026-96369"]
title: "Drupal Webform: sensitive data cached in browser exposes submissions to others"
severity: "low"
cvss: 3.1
epss: 0.0024
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "package", "self-hosted", "webform"]
not_affected_if: ["patched-version", "webform-not-installed"]
published_at: "2026-10-22T02:17:07+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:47:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96369", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-96369", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Drupal Webform: sensitive data cached in browser exposes submissions to others

Drupal's Webform module can leave sensitive information in the web browser cache because of incorrectly configured access control levels. An attacker with access to the same browser or a shared cache may read that cached data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Webform version with `drush pm:list --filter=webform` or the Drupal admin Extend page
- Compare the version against the affected range: 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1

## Fix

- Upgrade Drupal Webform to a version later than `6.3.1` and later than `6.2.12`, as stated in the advisory
- unknown for the exact patched release number

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96369
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-96369

## From the sources

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_