{"id":"CVE-2026-96364","aliases":["DRUPAL-CONTRIB-2026-171","EUVD-2026-107830","GHSA-m769-crqj-8pp9"],"status":"published","title":"Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171","description":"Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00287,"percentile":0.2146,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-799"],"published":"2026-09-23T16:26:32Z","modified":"2026-11-05T21:32:26Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/webform","fixed_in":["6.2.12","6.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/webform","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.12"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.3.0"},{"fixed":"6.3.1"}]}]}],"products":[{"vendor":"drupal","product":"webform"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-171","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96364","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m769-crqj-8pp9"},{"url":"https://git.drupalcode.org/project/webform","tags":["web"]},{"url":"https://www.drupal.org/project/webform","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96364.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-96364","title":"Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171","description":"Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","status":"published","published":"2026-10-22T01:21:36.412Z","modified":"2026-10-22T14:56:31.787Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-799"],"updated_at":"2026-11-02T14:20:00.511569Z"}],"euvd":[{"id":"EUVD-2026-107830","description":"Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","status":"published","published":"2026-10-22T01:21:36Z","modified":"2026-10-22T14:56:31Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:35.198677Z"}],"ghsa":[{"id":"GHSA-m769-crqj-8pp9","title":"Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality...","description":"Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","status":"published","published":"2026-10-22T03:33:43Z","modified":"2026-10-22T15:33:47Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-799"],"updated_at":"2026-11-02T15:14:16.352322Z"}],"nvd":[{"id":"CVE-2026-96364","description":"Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","status":"published","published":"2026-10-22T02:17:06.483Z","modified":"2026-10-22T16:54:17.39Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-799"],"updated_at":"2026-11-02T14:13:02.371082Z"}],"osv":[{"id":"CVE-2026-96364","title":"Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171","description":"Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","status":"published","published":"2026-10-22T01:21:36.412Z","modified":"2026-11-05T21:32:26.701389953Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-799"],"updated_at":"2026-11-05T22:00:34.245765Z"},{"id":"DRUPAL-CONTRIB-2026-171","description":"The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.\n\nThe Webform Share submodule can expose a webform for embedding on another site.\n\nUnder certain circumstances, submissions for an Ajax-enabled Webform using Webform Share can bypass anti-spam protections.\n\nThis vulnerability is mitigated by the fact that Webform Share must be enabled, sharing must be enabled for the affected webform, and the affected webform must rely on compatible Form-API-based anti-spam protections such as Honeypot or Antibot.","status":"published","published":"2026-09-23T16:26:32Z","modified":"2026-09-23T17:40:55.466345Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}