DRUPAL-CONTRIB-2026-161 CVE-2026-96363

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

Low Packagist

Severity: 3.1 / 10; Low · CVSS 3.1
Exploit chance (EPSS): 0.24%; Chance of exploitation in the next 30 days. Higher than 15.56% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-267 Privilege Defined With Unsafe Actions
Fix: 6.3.1; Upgrade drupal/webform to this version or later

Description

Webform includes a submodule called Webform Entity Print. This submodule doesn't sufficiently limit access to its print templates. When the submodule is enabled, a user with permissions to create a webform can exploit cross-site scripting (XSS) in submodule settings.

This vulnerability is mitigated by the fact that an attacker must have a role with create webform and edit own webform permissions, and the Webform Entity Print module must be enabled.

Affected versions

Packagist:https://packages.drupal.org/8

Package	Vulnerable	Fixed in
drupal/webform	`< 6.2.12` `>= 6.3.0, < 6.3.1`	`6.2.12` `6.3.1`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

drupal/webform Packagist:https://packages.drupal.org/8 → `6.3.1`

composer

composer require drupal/webform:^6.3.1

Severity breakdown

CVSS 3.1 3.1

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N

Attack vector: Network
Attack complexity: High
Privileges required: High
User interaction: Required
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: None

Weakness

CWE-267: Privilege Defined With Unsafe Actions

A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.

How to prevent it

Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design, Operation: Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.

References

Timeline

Sep 23, 2026 Published
Oct 30, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
DRUPAL-CONTRIB-2026-175 The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurable formats.	Critical	Also affects drupal/webform
DRUPAL-CONTRIB-2026-174 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.	Medium	Also affects drupal/webform
DRUPAL-CONTRIB-2026-173 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.	Medium	Also affects drupal/webform
DRUPAL-CONTRIB-2026-172 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.	Medium	Also affects drupal/webform
DRUPAL-CONTRIB-2026-171 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.	Medium	Also affects drupal/webform
DRUPAL-CONTRIB-2026-170 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.	High	Also affects drupal/webform
DRUPAL-CONTRIB-2026-169 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.	Medium	Also affects drupal/webform
DRUPAL-CONTRIB-2026-168 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.	Low	Also affects drupal/webform

Credits: Pierre Rudloff (prudloff)

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor