PT-2026-97664

CVE-2026-96372

Published

2026-09-23

Updated

2026-10-22

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal Webform versions 0.0.0 through 6.2.12 Drupal Webform versions 6.3.0 through 6.3.1

Description Insufficient granularity of access control in the Webform module allows forceful browsing. The module does not sufficiently restrict access to configure Remote HTTP Operations handlers, which could allow a user with permission to edit a webform to configure a remote HTTP operation.

Recommendations Update Drupal Webform versions 0.0.0 through 6.2.12 to a version where the Administer webform remote post URLs permission is implemented. Update Drupal Webform versions 6.3.0 through 6.3.1 to a version where the Administer webform remote post URLs permission is implemented. Review the Administer webform remote post URLs permission and ensure it is granted only to trusted roles.

Exploitability

Exploit

Fix

Researchers