CVE-2026-96372

mediumpriority · track · 0EPSS 0.002 · 15 %ileDEUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.24% (15th) EPSS

CVSS 5.4 · medium

Is it mine?

39 products

Check your exposure

Who says so?

2 sources

cert_bund · osv

EPSS · scored 2026-10-27

Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

cvss

Technical severity, 0–10. One row per scoring source.

5.4

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Nsecondaryexploitability 2.8 · impact 2.5

v3.15mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1220USCWE-1220US

affected products (39)

Products and version ranges known to be affected.

Open Source Drupal AI CKEditor <1.4.3all versionscert_bundDE
Open Source Drupal CSS Usage Analyzer <1.0.2all versionscert_bundDE
Open Source Drupal Cloud <7.0.1all versionscert_bundDE
Open Source Drupal Combined image style <1.0.7all versionscert_bundDE
Open Source Drupal Commerce Decoupled Checkout <1.8.0all versionscert_bundDE
Open Source Drupal CookieCuttr <2.0.3all versionscert_bundDE
Open Source Drupal Diba carousel slider <3.0.2all versionscert_bundDE
Open Source Drupal Editoria11y Accessibility Checker <2.2.23all versionscert_bundDE
Open Source Drupal Editoria11y Accessibility Checker <3.0.9all versionscert_bundDE
Open Source Drupal Mermaid Diagram Field <1.0.9all versionscert_bundDE
Open Source Drupal Project Browser <2.0.3all versionscert_bundDE
Open Source Drupal Project Browser <2.1.5all versionscert_bundDE
Open Source Drupal REST & JSON API Authentication <3.2.0all versionscert_bundDEcpe:/a:drupal:drupal:est__json_api_authentication__3.2.0
Open Source Drupal Smart Content <3.2.1all versionscert_bundDE
Open Source Drupal Stop administrator login <1.6all versionscert_bundDE
Open Source Drupal Tawk.to-Live chat application <3.0.4all versionscert_bundDE
Open Source Drupal Webform <6.2.12all versionscert_bundDE
Open Source Drupal Webform <6.3.1all versionscert_bundDE
Open Source Drupal Webform REST <4.2.1all versionscert_bundDE
Open Source Drupal≤ Editoria11y Accessibility Checker <2.2.23cert_bundDE

showing 20 of 39

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-3554Drupal Erweiterungen: Mehrere SchwachstellenDeutsch2026-09-23csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.
DRUPAL-CONTRIB-2026-1672026-09-23vendor · osvUS
The Webform module enables site builders to create forms and collect submissions. The module does not sufficiently restrict access to configure Remote HTTP Operations handlers. This vulnerability could allow a user with permission to edit a webform to configure a remote HTTP operation. The update adds the *Administer webform remote post URLs* permission. Review this permission and ensure it is granted only to trusted roles. The vulnerability is mitigated by the fact that an attacker must have a role with permission to edit a webform.

sources

Which sources assert this record, and when.

cert_bund osv NVD CVE.org MITRE

published 2026-10-22modified 2026-10-22

references (1) nvd

External citations — patches, advisories, analysis.

https://www.drupal.org/sa-contrib-2026-167

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan