CVE-2026-96369 in Webform
Summary
by MITRE • 10/22/2026
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in Drupal's Webform module represents a critical intersection of client-side caching mechanisms and server-side access control logic failures. This issue specifically affects versions ranging from the initial release up through version 6.2.12, as well as the specific range from 6.3.0 to 6.3.1. The core technical flaw lies in how the module handles form submissions and subsequent page rendering when caching is enabled or utilized by the end-user's web browser. In a properly secured environment, access control lists should strictly govern who can view submitted data or specific form configurations. However, due to improper cache configuration and lack of appropriate HTTP cache-control headers for sensitive pages, the Webform module inadvertently allows previously rendered forms containing sensitive information to be stored in the local browser cache.
From a technical perspective, this flaw stems from an incorrect implementation of security levels regarding access control when combined with web caching protocols. When a user accesses a form that requires authentication or specific permissions, and subsequently logs out or loses their session privileges, the browser may still retain the HTML content of that page in its local cache if no explicit directives prevent it. An attacker who has physical or logical access to such a cached environment can retrieve this stored data without needing valid credentials for subsequent requests. This effectively bypasses the intended security boundaries established by the Drupal core and the Webform module's permission settings, allowing unauthorized entities to view sensitive form submissions that were previously accessible only to authorized users during their active session.
The operational impact of this vulnerability is significant, particularly in environments handling personally identifiable information, financial data, or other regulated content through web forms. Because the cached pages contain the full structure and potentially submitted values from previous interactions, an attacker can exploit this misconfiguration to extract confidential details that were never intended for public consumption. This constitutes a direct violation of confidentiality principles within the CIA triad. The risk is exacerbated in shared computing environments or on devices where multiple users might access the same browser profile, as one user could inadvertently expose data belonging to another by simply navigating back through their browsing history after an authorized session has ended.
This vulnerability aligns with CWE-524, which categorizes issues related to the use of caches containing sensitive information, and is closely associated with CWE-613 regarding insufficient session expiration. In terms of offensive security frameworks like MITRE ATT&CK, this behavior facilitates data exfiltration through local storage abuse, allowing adversaries to harvest credentials or sensitive form data without triggering traditional network-based intrusion detection systems that monitor for active exploitation attempts against the server itself. The attack vector is primarily local and requires minimal effort from the adversary once they have access to a device where an authorized user has previously interacted with vulnerable Webform instances.
To mitigate this risk, administrators must immediately upgrade the Drupal Webform module to a version beyond 6.3.1 or apply available security patches that address these caching behaviors. It is imperative to configure web servers and application frameworks to send strict HTTP cache-control headers such as no-store, no-cache, and must-revalidate for pages containing sensitive form data or authentication-dependent content. Additionally, developers should ensure that session management practices are robust, including proper invalidation of sessions upon logout and the implementation of anti-forgery tokens where applicable. Regular security audits focusing on caching policies across all dynamic web applications will help prevent similar exposures in future deployments, ensuring that access control mechanisms remain effective regardless of client-side storage behaviors.