CVE-2026-96369 - Vulnerability Details - OpenCVE

ReportizFlow

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Drupal	Webform

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2026-165

History

Thu, 22 Oct 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N'}`

Thu, 22 Oct 2026 11:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Drupal Drupal webform
Vendors & Products		Drupal Drupal webform

Thu, 22 Oct 2026 01:45:00 +0000

Type	Values Removed	Values Added
Description		Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Title		Webform - Less critical - Access bypass - SA-CONTRIB-2026-165
Weaknesses		CWE-525
References		https://www.drupal.org/sa-contrib-2026-165

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2026-10-22T01:21:41.358Z

Updated: 2026-10-22T15:03:17.155Z

Reserved: 2026-09-23T01:32:48.995Z

Link: CVE-2026-96369

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-10-22T02:17:07.123

Modified: 2026-10-22T16:54:17.390

Link: CVE-2026-96369

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-96369", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2026-09-23T01:32:48.995Z", "datePublished": "2026-10-22T01:21:41.358Z", "dateUpdated": "2026-10-22T15:03:17.155Z"}, "containers": {"cna": {"title": "Webform - Less critical - Access bypass - SA-CONTRIB-2026-165", "datePublic": "2026-09-23T16:17:08.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-165"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-525", "description": "CWE-525 Use of Web Browser Cache Containing Sensitive Information", "lang": "en", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"collectionURL": "https://www.drupal.org/project/webform", "product": "Webform", "vendor": "Drupal", "repo": "https://git.drupalcode.org/project/webform", "versions": [{"lessThan": "6.2.12", "status": "affected", "version": "0.0.0", "versionType": "semver"}, {"lessThan": "6.3.1", "status": "affected", "version": "6.3.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1."}], "credits": [{"lang": "en", "type": "finder", "value": "Giuseppe (giuseppe87)"}, {"lang": "en", "type": "remediation developer", "value": "Damien McKenna (damienmckenna)"}, {"lang": "en", "type": "remediation developer", "value": "Jacob Rockowitz (jrockowitz)"}, {"lang": "en", "type": "remediation developer", "value": "Lee Rowlands (larowlan)"}, {"lang": "en", "type": "coordinator", "value": "Swan Kalata (akalata)"}, {"lang": "en", "type": "coordinator", "value": "Bram Driesen (bramdriesen)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Jacob Rockowitz (jrockowitz)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-10-22T01:21:41.358Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-22T15:03:10.772660Z", "id": "CVE-2026-96369", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-22T15:03:17.155Z"}}]}}