- Package
- drupal/webform
- Fixed in
- 6.2.12, 6.3.1
- Published
- Wed 23 Sep 2026, 17:18 LisbonUpdated Mon 26 Oct 2026, 02:26 Lisbon
In plain words
A user with permission to edit a webform could configure a Remote HTTP Operations handler because the module does not sufficiently restrict access to this configuration. The attacker must have a role that allows them to edit a webform.
Am I affected?
Look for drupal/webform and its version in composer.lock. The advisory lists fixes in 6.2.12 and 6.3.1 but gives no affected version range. Check which roles can edit webforms and therefore could configure Remote HTTP Operations handlers. After updating, review the Administer webform remote post URLs permission.
What to do
Check which version you have, then update to a fixed release for your branch (6.2.12, 6.3.1):
composer show drupal/webform | grep versions
composer update drupal/webformIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
Ensure the new Administer webform remote post URLs permission is granted only to trusted roles. The advisory also notes that an attacker must have a role with permission to edit a webform.
The advisory's description
The Webform module enables site builders to create forms and collect submissions.
The module does not sufficiently restrict access to configure Remote HTTP Operations handlers. This vulnerability could allow a user with permission to edit a webform to configure a remote HTTP operation.
The update adds the Administer webform remote post URLs permission. Review this permission and ensure it is granted only to trusted roles.
The vulnerability is mitigated by the fact that an attacker must have a role with permission to edit a webform.
The advisory
- OSV.dev: DRUPAL-CONTRIB-2026-167
- The week's digest, with the other advisories from 21 Sep 2026
- All advisories for drupal/webform