PatchClock

PHP security digest · 23 Sep 2026

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Webform did not sufficiently g...

Unrated CVE-2026-96356

Package
drupal/webform
Fixed in
6.2.12, 6.3.1
Published
Wed 23 Sep 2026, 17:27 LisbonUpdated Mon 26 Oct 2026, 02:27 Lisbon

In plain words

A malformed saved Webform access rule could let anonymous users access submissions intended only for selected user accounts. The bypass depends on malformed saved access-rule configuration and certain site-specific conditions.

Am I affected?

Find drupal/webform and its version in composer.lock. The advisory lists fixes in 6.2.12 and 6.3.1, but gives no affected version range. Review saved access rules that grant submission access to selected user accounts for malformed configuration. The advisory does not explain what makes the configuration malformed or specify the other site-specific conditions.

What to do

Check which version you have, then update to a fixed release for your branch (6.2.12, 6.3.1):

composer show drupal/webform | grep versions
composer update drupal/webform

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

The advisory says the vulnerability is mitigated by the bypass depending on malformed saved access-rule configuration.

The advisory's description

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

Webform did not sufficiently guard user-specific access rules against a malformed saved configuration. Under certain site-specific conditions, an access rule intended to grant submission access only to selected user accounts could also grant access to anonymous users.

This vulnerability is mitigated by the fact that the bypass depends on malformed saved access-rule configuration.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.