Live › vulnerability › CVE-2026-96372
Go to dashboardDrupal's Webform module has an access control gap that lets a user reach pages they should not see by guessing or forcing URLs. An attacker can read form content or submissions that the site meant to keep hidden from them.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Drupal sites that run the Webform module in the affected version ranges and publish or store forms with restricted data. Sites that do not use Webform, or that run a fixed release, are not exposed.
No product ranges from the sources yet.
drush pm:list --filter=webform or the Extend page in the Drupal admin.6.2.12 for the 6.2 line, or to 6.3.2 or later for the 6.3 line (unknown exact fixed release in sources; confirm on drupal.org).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-96372")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.