[IT-SecNots] [Security-news] Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-169

Project: Webform [1]
Project machine name: webform
Date: 2026-September-23
Security risk: *Moderately critical* 12 ∕ 25
AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2]
Vulnerability: Access bypass

Affected versions: <6.2.12 || >=6.3.0 <6.3.1
CVE IDs: CVE-2026-96366
Description: 
The Webform module allows site builders to create forms, collect submissions,
and configure access to forms and submission data.

Site builders may also configure handlers for processing submissions,
including email handlers that may include uploaded files as attachments.

In affected configurations, Webform did not sufficiently validate a managed
file upload element when processing a new submission. A user with access to
submit a vulnerable webform could potentially access other managed files they
were not authorized to view.

This vulnerability is mitigated by the fact that a site must have a Webform
with a managed file upload element and a configuration that exposes submitted
files, such as allowing users to view their own webform submissions or
sending uploads as email attachments.

Solution: 
Install the latest version:

 * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3].
 * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1 [4].

Reported By: 
 * Sandro Kneubühl (blackpharao) [5]
 * omidsec [6]

Fixed By: 
 * Jacob Rockowitz (jrockowitz) [7]

Coordinated By: 
 * Swan Kalata (akalata) [8] of the Drupal Security Team
 * Bram Driesen (bramdriesen) [9] of the Drupal Security Team
 * cilefen  (cilefen) [10] of the Drupal Security Team
 * Damien McKenna (damienmckenna) [11] of the Drupal Security Team
 * Heine Deelstra (heine) [12] of the Drupal Security Team
 * Drew Webber (mcdruid) [13] of the Drupal Security Team
 * Mohit Aghera (mohit_aghera) [14] provisional member of the Drupal Security
   Team
 * Juraj Nemec (poker10) [15] of the Drupal Security Team
 * Jess  (xjm) [16] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [17]

[1] https://www.drupal.org/project/webform
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/webform/releases/6.2.12
[4] https://www.drupal.org/project/webform/releases/6.3.1
[5] https://www.drupal.org/u/blackpharao
[6] https://www.drupal.org/u/omidsec
[7] https://www.drupal.org/u/jrockowitz
[8] https://www.drupal.org/u/akalata
[9] https://www.drupal.org/u/bramdriesen
[10] https://www.drupal.org/u/cilefen
[11] https://www.drupal.org/u/damienmckenna
[12] https://www.drupal.org/u/heine
[13] https://www.drupal.org/u/mcdruid
[14] https://www.drupal.org/u/mohit_aghera
[15] https://www.drupal.org/u/poker10
[16] https://www.drupal.org/u/xjm
[17]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3611218

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at