Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.1
CVE-2026-96369: Drupal Webform may expose cached sensitive data
CVE-2026-96369 · published 14 days ago
Summary
The Webform module for Drupal (versions up to 6.3.1) can store form contents in a web browser’s cache, allowing someone with access to the same computer to view information that should be private. This could expose personal or business details unintentionally. Clear browser caches regularly or configure the site to prevent caching of form pages to mitigate the risk.
What to do
- Update drupal drupal/webform to version 6.3.1.
- Update drupal webform to version 6.2.12 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Packagist:https://packages.drupal.org/8 | drupal | drupal/webform |
>= 6.3.0, < 6.3.1 Fix: upgrade to 6.3.1
|
| – | drupal | webform | < 6.2.12 |
Original advisory text
Webform - Less critical - Access bypass - SA-CONTRIB-2026-165
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
References
- https://www.drupal.org/sa-contrib-2026-165 URL
- https://git.drupalcode.org/project/webform URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96369... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-96369 Vendor Advisory
- https://www.drupal.org/project/webform URL
Severity
3.1
Low
Type
CWE-525Use of Web Browser Cache Containing Sensitive Information
Timeline
Published22 Oct 2026
Updated29 Oct 2026
First seen23 Sep 2026
Sources
DRUPAL-CONTRIB-2026-165 · OSV
CVE-2026-96369 · NVD
CVE-2026-96369 · MITRE
CVE-2026-96369 · OSV
Track software like this
Free during beta