PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-96370 Drupal CVE debrief

CVE-2026-96370 is an Incorrect Authorization vulnerability in Drupal Webform that allows Server Side Request Forgery. The issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1. This vulnerability could allow attackers to bypass access controls and make unauthorized requests on behalf of the server, potentially leading to data breaches or further exploitation. Defenders should prioritize verifying exposure in their Webform installations, especially those using affected versions, and assess the need for updates or compensating controls.

Vendor
Drupal
Product
Webform
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-22
Advisory published
2026-10-22
Advisory updated
2026-10-22

Who should care

Defenders managing Drupal Webform installations, especially those using affected versions, should assess exposure and prioritize verification and potential updates.

Why it matters

CVE-2026-96370 is an Incorrect Authorization vulnerability in Drupal Webform that allows Server Side Request Forgery, affecting versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1. Defenders should prioritize verifying exposure and assessing the need for updates or compensating controls.

  • Verify exposure in Webform installations
  • Assess the need for updates or patches
  • Implement compensating controls if updates are not feasible

Technical summary

The vulnerability in Drupal Webform allows for Server Side Request Forgery due to incorrect authorization. Affected versions include those from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1. This issue arises from the Webform module's failure to properly validate requests, allowing an attacker to make unauthorized requests. The vulnerability's impact includes potential data breaches and unauthorized access to sensitive information. Defenders should focus on verifying exposure, assessing the need for updates, and implementing compensating controls if necessary.

Defensive priority

Defenders should prioritize verifying exposure in their Webform installations, especially those using affected versions, and assess the need for updates or compensating controls.

Recommended defensive actions

  • Verify Webform version and check for exposure
  • Assess the need for updates or patches
  • Implement compensating controls if updates are not feasible

Evidence notes

The CVE record and source item provide details on the vulnerability and affected versions. However, additional information on exploitation or impact is limited.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-96370 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-96370

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-96370 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-96370

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.