CVE-2026-96372 in Webform
Summary
by MITRE • 10/22/2026
Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified security flaw resides within the Drupal Webform module and is classified as an Insufficient Granularity of Access Control vulnerability that facilitates Forceful Browsing. This issue impacts specific legacy versions of the software, namely those ranging from version 0.0.0 up to 6.2.12, as well as the subsequent release cycle spanning from 6.3.0 through 6.3.1. The core technical deficiency lies in the module's failure to enforce strict access control checks on certain administrative or internal endpoints associated with form submissions and configuration data. In a properly secured implementation, any request accessing sensitive backend resources must be validated against the user's current session permissions before processing occurs. However, due to this oversight, the application fails to verify whether the requesting entity possesses the requisite privileges for the specific action being attempted.
This architectural weakness allows authenticated users with lower privilege levels, or potentially unauthenticated attackers if authentication mechanisms are bypassed through other means, to access resources intended exclusively for administrators or higher-privileged roles. By manipulating URLs and directly invoking endpoints that should be restricted, an attacker can perform forceful browsing against the application's internal logic. This capability enables the unauthorized retrieval of sensitive information contained within webform submissions, such as personally identifiable information submitted by end-users, configuration details regarding form structures, and potentially administrative settings related to how data is processed or stored. The lack of granular checks means that the boundary between different user roles is porous, allowing lateral movement within the application's permission hierarchy without proper authorization validation.
From an operational impact perspective, this vulnerability poses a significant risk to data confidentiality and integrity. Since webforms are commonly used to collect sensitive personal data including names, contact details, financial information, or health records depending on the organization's use case, unauthorized access can lead to severe privacy violations and regulatory non-compliance with standards such as GDPR or HIPAA where applicable. Furthermore, if the vulnerability allows for more than just reading data, it could potentially be leveraged in conjunction with other flaws to modify form configurations or submit malicious payloads through forms that were not intended for public interaction. The ability to browse administrative interfaces without proper authorization undermines the trust model of the web application and exposes critical business logic to exploitation by any user who can guess or discover valid endpoint paths.
To mitigate this risk, organizations running affected versions must prioritize immediate patching. Updating the Drupal Webform module to a version newer than 6.3.1 is the primary remediation strategy as these releases contain fixes for access control enforcement mechanisms. Until an upgrade is feasible, administrators should implement compensating controls at the web server or firewall level by restricting direct access to known vulnerable endpoints based on IP whitelisting if those functions are only required from specific internal networks. Additionally, reviewing and hardening user roles within Drupal ensures that no single account has excessive privileges unless absolutely necessary for its function, adhering to the principle of least privilege. Regular security audits and penetration testing should be conducted to verify that access control rules are correctly applied across all modules and endpoints, ensuring that future updates do not reintroduce similar gaps in authorization logic.
This vulnerability aligns with CWE-284 which describes Improper Access Control, specifically highlighting failures where the application does not properly restrict access to resources for unauthorized actors. It also maps to MITRE ATT&CK techniques related to Discovery and Collection phases, such as T1078 Valid Accounts if exploited by authenticated users or T1596 Search Open Technical Databases if used to enumerate valid endpoints. The exploitation vector relies on the attacker's ability to predict or discover resource paths that lack proper server-side validation of user permissions. By addressing this gap through software updates and rigorous access control policies, organizations can effectively neutralize the threat posed by forceful browsing attacks against their Drupal-based web forms infrastructure.