CVE-2026-96372
CVE-2026-96372 · Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVSS 5.4 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
webform
- Versions
- ≥ 0.0.0, < 6.2.12: Affected (semver)
- ≥ 6.3.0, < 6.3.1: Affected (semver)
Update to 6.2.12; Update to 6.3.1
drupal/webform Packagist:https://packages.drupal.org/8
- Affected ranges
- ECOSYSTEM: < 6.2.12
- ECOSYSTEM: ≥ 6.3.0, < 6.3.1
Update to 6.2.12; Update to 6.3.1