Executive brief
The Webform module for Drupal allows site administrators to create forms and manage user submissions. When JSON:API is enabled, the module may cache submission data without properly accounting for which user is viewing it, potentially allowing one authenticated user to see another user's form responses. An attacker would need an account with permission to view their own submissions, and the webform must be exposed through JSON:API.
Technical details
The vulnerability is an improper cache variation flaw in the Webform module's JSON:API integration. When a webform is configured to allow authenticated users to view their own submissions, the collection endpoint may return cached responses that were generated for a different user, bypassing access controls. The attack requires JSON:API to be enabled, the webform to expose submissions through JSON:API, and the attacker to possess an authenticated account with view-own-submissions permission.
Affected products
- Drupal Webform <6.2.12, >=6.3.0 <6.3.1
Timeline
- 2026-09-23: disclosed