CVE-2026-96370 in Webform Module
Summary
by MITRE • 10/23/2026
Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The identified security flaw resides within the Drupal Webform module, specifically affecting version ranges spanning from initial releases up through 6.2.12 and versions 6.3.0 to 6.3.1. This vulnerability is classified as an incorrect authorization issue that facilitates Server Side Request Forgery attacks. The core technical deficiency lies in the insufficient validation of user-supplied input when processing form submissions or handling webhook integrations associated with external services. Because the application fails to properly enforce access controls on specific endpoints used for data retrieval or callback verification, an authenticated attacker can manipulate these inputs to direct the server into making unintended HTTP requests to internal or external resources that would otherwise be inaccessible.
From a technical perspective, this vulnerability aligns closely with CWE-918, which addresses Server-Side Request Forgery (SSRF). The flaw typically manifests when the application constructs URLs based on user-controlled data without adequate sanitization or allow-listing of permitted domains and protocols. In the context of Drupal Webform, this often occurs during integrations where forms submit data to third-party services such as payment gateways, email marketing platforms, or custom API endpoints. If an attacker can control a parameter that determines the destination URL for these callbacks or notifications, they can trick the server into initiating requests to internal network segments, cloud metadata services like AWS EC2 instance metadata, or local development servers running on localhost. This bypasses traditional perimeter defenses because the traffic originates from within the trusted application environment itself.
The operational impact of this vulnerability is significant and multifaceted. Initially, it allows for unauthorized data exfiltration by enabling attackers to read sensitive internal files or database configurations through crafted requests that return content in the response body. Furthermore, SSRF can be leveraged as a pivot point for further network reconnaissance, allowing an attacker to map out the internal network topology, identify vulnerable services running on private IP addresses, and potentially exploit other weaknesses within the backend infrastructure. In cloud environments, this vulnerability poses a critical risk of credential theft by accessing instance metadata endpoints that store temporary security credentials, API keys, and user data. This can lead to full compromise of the underlying server or even lateral movement across connected systems if combined with other exploitation techniques.
This behavior is also consistent with MITRE ATT&CK technique T1557, which covers Adversary-in-the-Middle scenarios where attackers use SSRF to intercept communications between internal services. Additionally, it relates to T1046 Network Service Discovery, as the attacker can probe various ports and services within the private network by observing response differences or error messages returned from the vulnerable application endpoint. The severity of this issue is heightened in shared hosting environments or microservices architectures where trust boundaries are less rigidly enforced between different components of the web stack.
Mitigation strategies must focus on strict input validation and output encoding principles applied to all URL parameters handled by the Webform module. Administrators should immediately upgrade to a patched version of Drupal Webform that resolves this authorization flaw, ensuring that only whitelisted domains are permitted for outbound requests from form submissions. Implementing network-level controls such as egress filtering can also reduce risk by blocking unauthorized outbound connections from web server processes. Furthermore, deploying a Web Application Firewall with specific rulesets designed to detect SSRF patterns in HTTP request headers and bodies provides an additional layer of defense. Regular security audits focusing on authorization logic for external integrations are recommended to prevent similar misconfigurations in future updates or custom modules interacting with the core system.