View online: https://www.drupal.org/sa-contrib-2026-167 Project: Webform [1] Project machine name: webform Date: 2026-September-23 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96372 Description: The Webform module enables site builders to create forms and collect submissions. The module does not sufficiently restrict access to configure Remote HTTP Operations handlers. This vulnerability could allow a user with permission to edit a webform to configure a remote HTTP operation. The update adds the /Administer webform remote post URLs/ permission. Review this permission and ensure it is granted only to trusted roles. The vulnerability is mitigated by the fact that an attacker must have a role with permission to edit a webform. Solution: Install the latest version: * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3]. * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.11 [4]. Review the new permission /Administer webform remote post URLs/ and ensure it is only granted to trusted roles. Reported By: * Pierre Rudloff (prudloff) [5] of the Drupal Security Team * Wesley Giles (seraphdev) [6] Fixed By: * Dan Chadwick (danchadwick) [7] * Jacob Rockowitz (jrockowitz) [8] * Liam Morland (liam morland) [9] Coordinated By: * Swan Kalata (akalata) [10] of the Drupal Security Team * Bram Driesen (bramdriesen) [11] of the Drupal Security Team * Greg Knaddison (greggles) [12] of the Drupal Security Team * Lee Rowlands (larowlan) [13] of the Drupal Security Team * Juraj Nemec (poker10) [14] of the Drupal Security Team * Pierre Rudloff (prudloff) [15] of the Drupal Security Team * Jess (xjm) [16] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [17] [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/6.2.12 [4] https://www.drupal.org/project/webform/releases/6.3.11 [5] https://www.drupal.org/u/prudloff [6] https://www.drupal.org/u/seraphdev [7] https://www.drupal.org/u/danchadwick [8] https://www.drupal.org/u/jrockowitz [9] https://www.drupal.org/u/liam-morland [10] https://www.drupal.org/u/akalata [11] https://www.drupal.org/u/bramdriesen [12] https://www.drupal.org/u/greggles [13] https://www.drupal.org/u/larowlan [14] https://www.drupal.org/u/poker10 [15] https://www.drupal.org/u/prudloff [16] https://www.drupal.org/u/xjm [17] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....