DRUPAL-CONTRIB-2026-171 CVE-2026-96364

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

Medium Packagist

Severity: 5.3 / 10; Medium · CVSS 3.1
Exploit chance (EPSS): 0.29%; Chance of exploitation in the next 30 days. Higher than 21.24% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-799 Improper Control of Interaction Frequency
Fix: 6.3.1; Upgrade drupal/webform to this version or later

Description

The Webform Share submodule can expose a webform for embedding on another site.

Under certain circumstances, submissions for an Ajax-enabled Webform using Webform Share can bypass anti-spam protections.

This vulnerability is mitigated by the fact that Webform Share must be enabled, sharing must be enabled for the affected webform, and the affected webform must rely on compatible Form-API-based anti-spam protections such as Honeypot or Antibot.

Affected versions

Packagist:https://packages.drupal.org/8

Package	Vulnerable	Fixed in
drupal/webform	`< 6.2.12` `>= 6.3.0, < 6.3.1`	`6.2.12` `6.3.1`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

drupal/webform Packagist:https://packages.drupal.org/8 → `6.3.1`

composer

composer require drupal/webform:^6.3.1

Severity breakdown

CVSS 3.1 5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: Low
Availability: None

Weakness

CWE-799: Improper Control of Interaction Frequency

The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.

References

Timeline

Sep 23, 2026 Published
Oct 22, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
DRUPAL-CONTRIB-2026-175 The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurable formats.	Critical	Also affects drupal/webform
DRUPAL-CONTRIB-2026-174 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.	Medium	Also affects drupal/webform
DRUPAL-CONTRIB-2026-173 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.	Medium	Also affects drupal/webform
DRUPAL-CONTRIB-2026-172 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.	Medium	Also affects drupal/webform
DRUPAL-CONTRIB-2026-170 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.	High	Also affects drupal/webform
DRUPAL-CONTRIB-2026-169 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.	Medium	Also affects drupal/webform
DRUPAL-CONTRIB-2026-168 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.	Low	Also affects drupal/webform
DRUPAL-CONTRIB-2026-167 The Webform module enables site builders to create forms and collect submissions.	Medium	Also affects drupal/webform

Credits: karing

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor