Is CVE-2026-96356 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96356 being exploited in the wild.

How severe is CVE-2026-96356?

Informational severity, published 22 October 2026.

Which products and versions are affected?

Drupal Webform All versions prior to 6.2.12, and 6.3.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform ECOSYSTEM:introduced=0,fixed=6.2.12|ECOSYSTEM:introduced=6.3.0,fixed=6.3.1.

Is there a fix for CVE-2026-96356?

Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform: upgrade to 6.2.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-96356 attacked?

It is attacked over the network.

Am I affected by CVE-2026-96356?

Check whether you run Drupal Webform or Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96356: Drupal Webform access control bypass with malformed configuration

CVE-2026-96356 · Severity: info · Published 2026-10-22

The Webform module for Drupal allows site builders to create forms and control who can view submissions. A flaw in how the module processes access rules could incorrectly grant anonymous users access to submissions that should only be visible to specific user accounts, but only if the access configuration is malformed. This could expose sensitive form submission data to unauthorized visitors.

Technologies: Drupal Webform, Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform. Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-96356 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96356 being exploited in the wild.
How severe is CVE-2026-96356?: Informational severity, published 22 October 2026.
Which products and versions are affected?: Drupal Webform All versions prior to 6.2.12, and 6.3.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform ECOSYSTEM:introduced=0,fixed=6.2.12|ECOSYSTEM:introduced=6.3.0,fixed=6.3.1.
Is there a fix for CVE-2026-96356?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform: upgrade to 6.2.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96356 attacked?: It is attacked over the network.
Am I affected by CVE-2026-96356?: Check whether you run Drupal Webform or Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform: upgrade to 6.2.12 or later

Technical details

Webform did not sufficiently validate user-specific access rules against malformed saved configurations, allowing an access-control bypass where anonymous users could gain submission access intended only for selected authenticated accounts. The vulnerability requires site-specific conditions and depends on malformed saved access-rule configuration to be exploited. Fixes are available in versions 6.2.12 and 6.3.1.

Affected products

Drupal Webform All versions prior to 6.2.12, and 6.3.0

Identifiers

CVE-2026-96356
DRUPAL-CONTRIB-2026-174

Timeline

2026-09-23: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.