{"id":"CVE-2026-96369","summary":"Webform - Less critical - Access bypass - SA-CONTRIB-2026-165","details":"Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","aliases":["DRUPAL-CONTRIB-2026-165"],"modified":"2026-10-23T02:46:15.100346729Z","published":"2026-10-22T01:21:41.358Z","database_specific":{"cna_assigner":"drupal","cwe_ids":["CWE-525"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96369.json"},"references":[{"type":"WEB","url":"https://git.drupalcode.org/project/webform"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96369.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96369"},{"type":"WEB","url":"https://www.drupal.org/project/webform"},{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-165"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.drupalcode.org/project/webform","events":[{"introduced":"0"},{"fixed":"2260bf0af45a003bb30caff899e76b1b3b250319"},{"introduced":"7ec7703769bb3d4fe87207c6765aaa3faafb0bd5"},{"fixed":"55fa7a9d6cfe1f9be07a9ab95dada21d70900f76"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0.0.0"},{"fixed":"6.2.12"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"6.3.0"},{"fixed":"6.3.1"}]}]}}],"versions":["6.2.11-rc2","6.2.11","6.2.11-rc1","6.2.10-rc3","6.2.10","6.2.10-rc2","6.2.10-rc1","6.2.10-beta1","6.2.9","6.2.8","6.2.7","6.2.5","6.2.4-rc1","6.2.4","6.2.2","6.2.1","6.2.0-rc4","6.2.0","6.2.0-rc3","6.2.0-rc2","6.2.0-rc1","6.2.0-beta7","6.2.0-beta6","6.2.0-beta5","6.2.0-beta4","6.2.0-beta3","6.2.0-beta2","6.2.0-beta1","6.1.2","6.1.1","6.1.0","6.1.0-beta2","6.0.4","6.1.0-beta1","6.0.3","6.0.1","6.0.0","6.0.0-beta3","6.0.0-beta2","6.0.0-beta1","6.0.0-alpha21","6.0.0-alpha20","6.0.0-alpha19","6.0.0-alpha18","6.0.0-alpha17","6.0.0-alpha16","6.0.0-alpha15","6.0.0-alpha14","6.0.0-alpha13","6.0.0-alpha12","6.0.0-alpha11","6.0.0-alpha10","6.0.0-alpha9","6.0.0-alpha8","6.0.0-alpha7","6.0.0-alpha6","6.0.0-alpha5","6.0.0-alpha4","6.0.0-alpha-4","6.0.0-alpha-3","6.0.0-alpha3","6.0.0-alpha2","6.0.0-alpha1","8.x-5.14-beta2","8.x-5.14-beta1","8.x-5.13","8.x-5.10","8.x-5.9","8.x-5.9-beta2","8.x-5.9-beta1","8.x-5.7","8.x-5.7.beta1","8.x-5.7-beta1","8.x-5.6","8.x-5.6-beta1","8.x-5.5-beta2","8.x-5.5-beta1","8.x-5.4","8.x-5.4-beta1","8.x-5.3","8.x-5.3-rc3","8.x-5.3-rc2","8.x-5.3-rc1","8.x-5.3-beta3","8.x-5.3-beta2","8.x-5.3-beta1","8.x-5.2","8.x-5.2-rc3","8.x-5.2-rc2","8.x-5.2-rc1","8.x-5.2-beta1","8.x-5.1","8.x-5.0","8.x-5.0-rc31","8.x-5.0-rc30","8.x-5.0-rc29","8.x-5.0-rc28","8.x-5.0-rc27","8.x-5.0-rc26","8.x-5.0-rc25","8.x-5.0-rc24","8.x-5.0-rc23","8.x-5.0-rc22","8.x-5.0-rc21","8.x-5.0-rc20","8.x-5.0-rc19","8.x-5.0-rc18","8.x-5.0-rc17","8.x-5.0-rc16","8.x-5.0-rc15","8.x-5.0-rc14","8.x-5.0-rc13","8.x-5.0-rc12","8.x-5.0-rc11","8.x-5.0-rc10","8.x-5.0-rc9","8.x-5.0-rc8","8.x-5.0-rc7","8.x-5.0-rc6","8.x-5.0-rc5","8.x-5.0-rc4","8.x-5.0-rc3","8.x-5.0-rc2","8.x-5.0-rc1","8.x-5.0-beta25","8.x-5.0-beta23","8.x-5.0-beta22","8.x-5.0-beta21","8.x-5.0-beta20","8.x-5.0-beta19","8.x-5.0-beta18","8.x-5.0-beta17","8.x-5.0-beta16","8.x-5.0-beta15","8.x-5.0-beta14","8.x-5.0-beta13","8.x-5.0-beta12","8.x-5.0-beta11","8.x-5.0-beta10","8.x-5.0-beta9","8.x-5.0-beta8","8.x-5.0-beta7","8.x-5.0-beta6","8.x-5.0-beta5","8.x-5.0-beta4","8.x-5.0-beta3","8.x-5.0-beta2","8.x-5.0-beta1","7.x-4.14","7.x-4.13","7.x-4.12","7.x-4.11","7.x-4.10","7.x-4.9","7.x-4.8","7.x-4.7","7.x-4.6","7.x-4.5","7.x-4.4","7.x-4.3","7.x-4.2","7.x-4.1","7.x-4.0","7.x-4.0-rc6","7.x-4.0-rc5","7.x-4.0-rc4","7.x-4.0-rc3","7.x-4.0-rc2","7.x-4.0-rc1","7.x-4.0-beta3","7.x-4.0-beta2","7.x-4.0-beta1","7.x-4.0-alpha10","7.x-4.0-alpha9","7.x-4.0-alpha8","7.x-4.0-alpha7","7.x-4.0-alpha6","7.x-4.0-alpha5","7.x-4.0-alpha4","7.x-4.0-alpha3","7.x-3.18","7.x-4.0-alpha2","7.x-4.0-alpha1","7.x-3.17","7.x-3.16","7.x-3.15","7.x-3.12","7.x-3.11","7.x-3.9","7.x-3.7","7.x-3.4-beta1","7.x-3.3-beta1","7.x-3.0-beta8","7.x-3.0-beta7","6.x-3.0","7.x-3.0-beta6","7.x-3.0-beta5","7.x-3.0-beta4","7.x-3.0-beta3","7.x-3.0-beta2","6.x-3.0-beta2","6.x-3.0-beta1","6.x-2.0-beta1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96369.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"}]}