CVE-2026-96370
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Drupal Webform module has an incorrect authorization vulnerability, allowing Server Side Request Forgery (SSRF). This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
Risk Assessment
An attacker could force the server to make requests to internal resources, potentially leading to information disclosure or interaction with internal services. This could be used to scan the internal network.
Recommendation
Update the Webform module to a version later than 6.2.12 or 6.3.1 that contains the fix. Restrict outbound requests from the web server.
Other vulnerabilities in Drupal Webform
See all- CVE-2026-96355Critical
The Webform module for Drupal (versions 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1) is vulnerable to code injection due to improper neutralization of special elements used in a template engine.
- CVE-2026-96398Medium
The Drupal Webform module contains an Incorrect Authorization vulnerability that allows Forceful Browsing. The issue affects versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96373Low
The Drupal Webform module contains an incorrect authorization vulnerability allowing forceful browsing. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96372Medium
The Drupal Webform module has an insufficient granularity of access control vulnerability, allowing forceful browsing. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96371Medium
The Drupal Webform module contains a Privilege Defined With Unsafe Actions vulnerability that allows stored XSS. The issue affects versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96369Low
The Drupal Webform module uses browser cache containing sensitive information due to incorrectly configured access control security levels. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96368Medium
The Drupal Webform module has an improper neutralization of input during web page generation vulnerability, leading to stored Cross-site Scripting (XSS). This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96367Medium
The Webform module for Drupal contains a Privilege Defined With Unsafe Actions vulnerability that allows Stored XSS. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96366Medium
The Drupal Webform module has an incorrect authorization vulnerability, allowing forceful browsing. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96365High
The Drupal Webform module contains an Allocation of Resources Without Limits or Throttling vulnerability allowing Excessive Allocation. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
Original NVD description (English source)
Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS