DRUPAL-CONTRIB-2026-167 CVE-2026-96372
The Webform module enables site builders to create forms and collect submissions.
- Severity
- 5.4 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.24%
- Chance of exploitation in the next 30 days. Higher than 15.35% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1220 Insufficient Granularity of Access Control
- Fix
6.3.1- Upgrade drupal/webform to this version or later
Description
The Webform module enables site builders to create forms and collect submissions.
The module does not sufficiently restrict access to configure Remote HTTP Operations handlers. This vulnerability could allow a user with permission to edit a webform to configure a remote HTTP operation.
The update adds the Administer webform remote post URLs permission. Review this permission and ensure it is granted only to trusted roles.
The vulnerability is mitigated by the fact that an attacker must have a role with permission to edit a webform.
Affected versions
Packagist:https://packages.drupal.org/8
| Package | Vulnerable | Fixed in |
|---|---|---|
| drupal/webform | < 6.2.12>= 6.3.0, < 6.3.1 |
6.2.126.3.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
drupal/webform Packagist:https://packages.drupal.org/8 → 6.3.1
- composer
composer require drupal/webform:^6.3.1
Severity breakdown
CVSS 3.1 5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Weakness
CWE-1220: Insufficient Granularity of Access Control
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
How to prevent it
- Architecture and Design, Implementation, Testing: Access-control-policy protections must be reviewed for design inconsistency and common weaknesses. Access-control-policy definition and programming flow must be tested in pre-silicon, post-silicon testing.
References
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| DRUPAL-CONTRIB-2026-175 The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurable formats. | Critical | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-174 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Medium | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-173 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Medium | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-172 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Medium | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-171 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Medium | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-170 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | High | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-169 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Medium | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-168 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Low | Also affects drupal/webform |
Credits: Pierre Rudloff (prudloff), Wesley Giles (seraphdev)
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor