PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-96373 Drupal CVE debrief

CVE-2026-96373 Webform Access Bypass Vulnerability: Drupal Webform versions from 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1 are affected by an Incorrect Authorization vulnerability, allowing for Forceful Browsing. This issue has been publicly disclosed and requires immediate attention from Drupal Webform users. The vulnerability allows attackers to bypass access controls and potentially access sensitive information. Users should review and update Webform to a secure version, implement additional access controls, and monitor for potential exploitation attempts.

Vendor
Drupal
Product
Webform
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-22
Advisory published
2026-10-22
Advisory updated
2026-10-22

Who should care

Drupal Webform users, administrators, and security teams should assess exposure and prioritize remediation. Affected operator, platform, vulnerability-management, and security-team impact should be evaluated to ensure proper mitigation and protection.

Why it matters

CVE-2026-96373 is an Incorrect Authorization vulnerability in Drupal Webform that allows Forceful Browsing, affecting versions from 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1. Users should review and update Webform to a secure version, implement additional access controls, and monitor for potential exploitation attempts.

  • Potential unauthorized access to sensitive information
  • Possible disruption of Webform functionality
  • Need for verification of Webform configurations and user permissions
  • Requirement for updates to prevent exploitation

Technical summary

The Drupal Webform module is vulnerable to an Incorrect Authorization issue, allowing attackers to bypass access controls and potentially access sensitive information. The vulnerability affects Webform versions from 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1.

Defensive priority

High

Recommended defensive actions

  • Review and update Drupal Webform to version 6.2.13 or 6.3.2, or later
  • Implement additional access controls and monitoring to detect potential exploitation attempts
  • Verify Webform configurations and user permissions to prevent unauthorized access

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and references to official advisories. The vulnerability affects Webform versions from 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1. The official CVE Program record and NIST NVD detail page provide additional information on the vulnerability and its impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-96373 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-96373

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-96373 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-96373

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.