Drupal Webform Cache Exposure via Access Control Misconfig (v6.2.12 & 6.3.1)
CVE-2026-96369 Published on October 22, 2026
Webform - Less critical - Access bypass - SA-CONTRIB-2026-165
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Vulnerability Analysis
CVE-2026-96369 can be exploited with network access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Type
Use of Web Browser Cache Containing Sensitive Information
The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.
Affected Versions
Drupal Webform:- Version 0.0.0 and below 6.2.12 is affected.
- Version 6.3.0 and below 6.3.1 is affected.