CVE-2026-96398

Name of the Vulnerable Software and Affected Versions Drupal Webform versions 0.0.0 through 6.2.12 Drupal Webform versions 6.3.0 through 6.3.1

Description An incorrect authorization issue allows forceful browsing within the Webform module. The module fails to sufficiently restrict access to specific submission view modes. Consequently, a user with permission to view a submission may access a more permissive view mode to see fields that should be restricted. This requires the attacker to already possess access to view the affected submission.

Recommendations Update Drupal Webform versions 0.0.0 through 6.2.12 to a version newer than 6.2.12. Update Drupal Webform versions 6.3.0 through 6.3.1 to a version newer than 6.3.1.