PatchClock

PHP security digest · 23 Sep 2026

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module did not sufficientl...

Unrated CVE-2026-96398

Package
drupal/webform
Fixed in
6.2.12, 6.3.1
Published
Wed 23 Sep 2026, 17:27 LisbonUpdated Mon 26 Oct 2026, 03:25 Lisbon

In plain words

A user who can already view a Webform submission may be able to access a more permissive submission view mode. Under certain conditions, this can reveal fields that would otherwise be restricted.

Am I affected?

Look for drupal/webform and its version in composer.lock. The listed fixed versions are 6.2.12 and 6.3.1, but the advisory gives no affected version range. Review submission access and view modes, particularly whether users with access to a submission could see otherwise restricted fields through a more permissive view mode.

What to do

Check which version you have, then update to a fixed release for your branch (6.2.12, 6.3.1):

composer show drupal/webform | grep versions
composer update drupal/webform

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

The vulnerability is mitigated by the requirement that an attacker must already have access to view the affected submission.

The advisory's description

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

The module did not sufficiently restrict access to certain submission view modes. Under certain conditions, a user who can view a submission could access a more permissive view mode and see fields that would otherwise be restricted.

This vulnerability is mitigated by the fact that an attacker must already have access to view the affected submission.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.