Project:
Project machine name:
webformDate:
2026-September-23
Vulnerability:
Access bypass
Affected versions:
<6.2.12 || >=6.3.0 <6.3.1
CVE IDs:
CVE-2026-96364
Description:
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.
The Webform Share submodule can expose a webform for embedding on another site.
Under certain circumstances, submissions for an Ajax-enabled Webform using Webform Share can bypass anti-spam protections.
This vulnerability is mitigated by the fact that Webform Share must be enabled, sharing must be enabled for the affected webform, and the affected webform must rely on compatible Form-API-based anti-spam protections such as Honeypot or Antibot.
Solution:
Install the latest version:
- If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
- If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.
Reported By:
Fixed By:
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Damien McKenna (damienmckenna) of the Drupal Security Team
- Mori Sugimoto (dokumori) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
