CVE-2026-96366

Name of the Vulnerable Software and Affected Versions Drupal Webform (affected versions not specified)

Description Insufficient validation of a managed file upload element during the processing of new submissions allows a user with submission access to potentially access other managed files they are not authorized to view. This issue occurs when a site is configured with a Webform containing a managed file upload element and a configuration that exposes submitted files, such as allowing users to view their own submissions or sending uploads as email attachments. Approximately 436,400 instances are identified globally.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.