[IT-SecNots] [Security-news] Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-171

Project: Webform [1]
Project machine name: webform
Date: 2026-September-23
Security risk: *Moderately critical* 14 ∕ 25
AC:Basic/A:None/CI:None/II:Some/E:Exploit/TD:Uncommon [2]
Vulnerability: Access bypass

Affected versions: <6.2.12 || >=6.3.0 <6.3.1
CVE IDs: CVE-2026-96364
Description: 
The Webform module allows site builders to create forms, collect submissions,
and configure access to forms and submission data.

The Webform Share submodule can expose a webform for embedding on another
site.

Under certain circumstances, submissions for an Ajax-enabled Webform using
Webform Share can bypass anti-spam protections.

This vulnerability is mitigated by the fact that Webform Share must be
enabled, sharing must be enabled for the affected webform, and the affected
webform must rely on compatible Form-API-based anti-spam protections such as
Honeypot or Antibot.

Solution: 
Install the latest version:

 * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3].
 * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1 [4].

Reported By: 
 * karing [5]

Fixed By: 
 * Alan Dixon (adixon) [6]
 * Dan Chadwick (danchadwick) [7]
 * Jacob Rockowitz (jrockowitz) [8]
 * Liam Morland (liam morland) [9]

Coordinated By: 
 * Swan Kalata (akalata) [10] of the Drupal Security Team
 * Bram Driesen (bramdriesen) [11] of the Drupal Security Team
 * Damien McKenna (damienmckenna) [12] of the Drupal Security Team
 * Mori Sugimoto (dokumori) [13] of the Drupal Security Team
 * Juraj Nemec (poker10) [14] of the Drupal Security Team
 * Jess  (xjm) [15] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [16]

[1] https://www.drupal.org/project/webform
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/webform/releases/6.2.12
[4] https://www.drupal.org/project/webform/releases/6.3.1
[5] https://www.drupal.org/u/karing
[6] https://www.drupal.org/u/adixon
[7] https://www.drupal.org/u/danchadwick
[8] https://www.drupal.org/u/jrockowitz
[9] https://www.drupal.org/u/liam-morland
[10] https://www.drupal.org/u/akalata
[11] https://www.drupal.org/u/bramdriesen
[12] https://www.drupal.org/u/damienmckenna
[13] https://www.drupal.org/u/dokumori
[14] https://www.drupal.org/u/poker10
[15] https://www.drupal.org/u/xjm
[16]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3611209

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at