PatchClock

PHP security digest · 23 Sep 2026

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The Webform Share submodule ca...

Unrated CVE-2026-96364

Package
drupal/webform
Fixed in
6.2.12, 6.3.1
Published
Wed 23 Sep 2026, 17:26 LisbonUpdated Mon 26 Oct 2026, 03:25 Lisbon

In plain words

An attacker can bypass anti-spam protections when submitting an Ajax-enabled webform exposed through Webform Share, under certain circumstances. This requires Webform Share to be enabled, sharing to be enabled for that webform, and the form to rely on compatible Form-API-based anti-spam protections such as Honeypot or Antibot.

Am I affected?

Look for drupal/webform and its version in composer.lock. The advisory lists fixes in 6.2.12 and 6.3.1 but gives no affected version range. Check whether Webform Share is enabled and whether any Ajax-enabled webform has sharing enabled and relies on compatible Form-API-based anti-spam protections such as Honeypot or Antibot.

What to do

Check which version you have, then update to a fixed release for your branch (6.2.12, 6.3.1):

composer show drupal/webform | grep versions
composer update drupal/webform

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

The advisory identifies these limiting conditions: Webform Share must be enabled, sharing must be enabled for the affected webform, and the form must rely on compatible Form-API-based anti-spam protections such as Honeypot or Antibot.

The advisory's description

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

The Webform Share submodule can expose a webform for embedding on another site.

Under certain circumstances, submissions for an Ajax-enabled Webform using Webform Share can bypass anti-spam protections.

This vulnerability is mitigated by the fact that Webform Share must be enabled, sharing must be enabled for the affected webform, and the affected webform must rely on compatible Form-API-based anti-spam protections such as Honeypot or Antibot.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.