View online: https://www.drupal.org/sa-contrib-2026-165 Project: Webform [1] Project machine name: webform Date: 2026-September-23 Security risk: *Less critical* 8 ∕ 25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96369 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. When Webform is used with JSON:API enabled, submissions may be cached without varying correctly by the authenticated user. If a webform is configured so that authenticated users can view their own submissions, a request to the JSON:API webform submission collection can return a cached response generated for a different user. This can allow an authenticated user to view another user's webform submission data through the JSON:API collection endpoint. This vulnerability is mitigated by the fact that JSON:API must be enabled, the affected webform must expose submissions through JSON:API, and the attacker must have an account with permission to view their own submissions for the affected webform. Solution: Install the latest version: * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3]. * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1 [4]. Reported By: * Giuseppe (giuseppe87) [5] Fixed By: * Damien McKenna (damienmckenna) [6] of the Drupal Security Team * Jacob Rockowitz (jrockowitz) [7] * Lee Rowlands (larowlan) [8] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Bram Driesen (bramdriesen) [10] of the Drupal Security Team * Greg Knaddison (greggles) [11] of the Drupal Security Team * Jacob Rockowitz (jrockowitz) [12] * Juraj Nemec (poker10) [13] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [14] [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/6.2.12 [4] https://www.drupal.org/project/webform/releases/6.3.1 [5] https://www.drupal.org/u/giuseppe87 [6] https://www.drupal.org/u/damienmckenna [7] https://www.drupal.org/u/jrockowitz [8] https://www.drupal.org/u/larowlan [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/bramdriesen [11] https://www.drupal.org/u/greggles [12] https://www.drupal.org/u/jrockowitz [13] https://www.drupal.org/u/poker10 [14] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....