{"id":"CVE-2026-96373","kind":"vulnerability","aliases":["CVE-2026-96373"],"related":[],"title":"Drupal Webform: incorrect authorization lets users browse restricted pages","description":"Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","summary":"Webform for Drupal has an authorization flaw that lets a user reach pages they should not see through forceful browsing. The sources do not say what data those pages expose.","severity":"low","cvss":3.3,"epss":0.00178,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","self-hosted","webform"],"not_affected_if":["webform-not-installed"],"how_to_check":"- Check the installed Webform version with `drush pm:list --filter=webform` or the Drupal extend page; affected versions are up to `6.2.12` and `6.3.0` through `6.3.1`.","fix":"- Upgrade Webform to a release later than `6.3.1` (the sources do not name the exact fixed version).","status":"open","published_at":"2026-10-22T02:17:07+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:45:53+00:00","updated_at":"2026-10-25T04:45:53+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:45:53Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Webform to a release later than `6.3.1` (the sources do not name the exact fixed version).","reach":"internet","title":"Drupal Webform: incorrect authorization lets users browse restricted pages","impact":"low","summary":"Webform for Drupal has an authorization flaw that lets a user reach pages they should not see through forceful browsing. The sources do not say what data those pages expose.","category":"package","nicknames":[],"who_cares":["drupal","webform","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown data exposure through unauthorized page access","analyst_note":"Find the fixed Webform version and the exact pages or permissions affected via the NVD entry and the Drupal security advisory.","how_to_check":"- Check the installed Webform version with `drush pm:list --filter=webform` or the Drupal extend page; affected versions are up to `6.2.12` and `6.3.0` through `6.3.1`.","needs_analyst":true,"not_affected_if":["webform-not-installed"],"who_is_affected":"Drupal sites that run the Webform module in the affected version range. The sources do not say which Webform features or configurations are required to be exposed, so unknown whether all installs are reachable.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000567,"input_tokens":3327,"output_tokens":469,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-96373':12A,15A '0.0.0':67C '6.2.12':69C '6.3.0':71C '6.3.1':73C 'affect':63C 'allow':58C 'author':4A,27B,53C 'brows':7A,41B,60C 'cve':10A,13A 'data':48B 'drupal':1A,16B,24B,56C 'expos':51B 'flaw':28B 'forc':40B,59C 'host':20B 'incorrect':3A,52C 'issu':62C 'let':5A,30B 'packag':17B 'page':9A,34B,50B 'reach':33B 'restrict':8A 'say':46B 'see':38B 'self':19B 'self-host':18B 'sourc':43B 'user':6A,32B 'version':65C 'vulner':54C 'webform':2A,21B,22B,57C,64C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the Webform module in the affected version range. The sources do not say which Webform features or configurations are required to be exposed, so unknown whether all installs are reachable.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96373","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96373","severity":null,"published_at":"2026-10-22T02:17:07+00:00","modified_at":"2026-10-22T16:54:17+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96373","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96373","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}