CVE-2026-96355 Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

EUVD-2026-107826

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96356 Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96356

The Drupal Webform module contains an Incorrect Authorization vulnerability (CWE-863) that enables Forceful Browsing . The root cause is a failure to sufficiently guard user-specific access rules against malformed saved configurations . Under specific site conditions, these rules may inadvertentl...

EUVD-2026-107815

Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1...

CVE-2026-96391 Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186

Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1...

CVE-2026-96391

The Drupal Webform REST module (versions 0.0.0 to 4.2.1 ) is vulnerable to an access bypass due to missing authorization checks. The root cause is the module's failure to sufficiently verify permissions when retrieving webform elements or fields , as well as webform submission entities . This fla...

DRUPAL-CONTRIB-2026-175

The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurable formats. Webform does not sufficiently exclude certain format templates from token replacement. This can allow an attacker to submit data that is evaluated as template code wh...

DRUPAL-CONTRIB-2026-174

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Webform did not sufficiently guard user-specific access rules against a malformed saved configuration. Under certain site-specific conditions, an access rule intended t...

DRUPAL-CONTRIB-2026-173

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module did not sufficiently restrict access to certain submission view modes. Under certain conditions, a user who can view a submission could access a more...

DRUPAL-CONTRIB-2026-172

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Form submissions may include uploaded files. The module does not sufficiently force certain uploaded file types to download when served. Under certain site...

DRUPAL-CONTRIB-2026-171

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The Webform Share submodule can expose a webform for embedding on another site. Under certain circumstances, submissions for an Ajax-enabled Webform using Webform Share...

DRUPAL-CONTRIB-2026-170

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configure handlers for processing submissions. Forms may be displayed in blocks. Webform does not sufficiently validate an optional token query...

DRUPAL-CONTRIB-2026-169

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configure handlers for processing submissions, including email handlers that may include uploaded files as attachments. In affected configuration...

DRUPAL-CONTRIB-2026-168

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently validate requested filenames when serving generated submission exports. Under certain configurations, a user with permission to view...

DRUPAL-CONTRIB-2026-167

The Webform module enables site builders to create forms and collect submissions. The module does not sufficiently restrict access to configure Remote HTTP Operations handlers. This vulnerability could allow a user with permission to edit a webform to configure a remote HTTP operation. The update...

DRUPAL-CONTRIB-2026-166

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently restrict access to raw webform source editing when the Webform UI module is not enabled. This could allow a user with webform creation ...

DRUPAL-CONTRIB-2026-165

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. When Webform is used with JSON:API enabled, submissions may be cached without varying correctly by the authenticated user. If a webform is configured so that...

DRUPAL-CONTRIB-2026-164

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a Webform Submission Export/Import submodule that allows importing submission data from uploaded CSV files or remote URLs. The submodule did not...

DRUPAL-CONTRIB-2026-163

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may add tooltips and help text to these forms. Some Webform tooltips and help text were not sufficiently sanitized, resulting in possible cross-site...