EUVD-2026-107830
GHSA-m769-crqj-8pp9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public Webform endpoint
-
ExploitBypass interaction-frequency control
-
ImpactRepeatedly misuse form functionality
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Interaction frequency control
|
| Exploitation Conditions | Requires a deployed Drupal site running the Webform module (versions 0.0.0-6.2.12 or 6.3.0-6.3.1) with at least one form that relies on an interaction-frequency control - such as submission/rate limits - whose enforcement can be circumvented. Per the CVSS vector no authentication (PR:N) or user interaction (UI:N) is needed, so public-facing forms are exploitable by remote attackers; the practical limiting factor is that a form must actually use the affected frequency-control feature, and the impact is bounded to misuse of that functionality (I:L) with no confidentiality or availability effect. The precise condition that defeats the frequency control is not described in the available sources. |
| Impact | This is a moderate-severity, low-urgency issue rather than a top priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N = 5.3) describes a remotely reachable, low-complexity, unauthenticated flaw whose only impact is a Low integrity hit (C:N, A:N) - consistent with CWE-799 (Improper Control of Interaction Frequency) and the 'Functionality Misuse' outcome, i.e. bypassing a rate/submission limit rather than compromising data or availability. The exploitation-probability signals reinforce low urgency: EPSS is 0.15% (4th percentile), the CVE is not on CISA KEV, and no public exploit is identified; the vuldb and Drupal references are advisories, not working exploit code. The vuln.today decision label is 'this_month' (routine patching), which aligns with the quantitative signals. One conflict to flag: the 'Information Disclosure' tag contradicts the CVSS metrics, which set C:N (no confidentiality impact) and attribute impact solely to integrity - this flaw does not appear to disclose data, so treat the disclosure framing as suspect and verify against the Drupal advisory (SA-contrib-2026-171). |
| Exploit ScenarioDerived | A remote, unauthenticated attacker repeatedly submits a publicly reachable Webform configured with an interaction-frequency control (such as a per-user or per-form submission limit), abusing a weakness in that control to exceed the intended limit. Because AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special tooling is needed, but the real-world impact is confined to functionality misuse (Low integrity) rather than data theft or outage. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
Functionality misuse in the Drupal Webform contributed module (versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1) lets remote, unauthenticated attackers circumvent interaction-frequency controls such as submission or rate limits on affected forms. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) limits impact to low integrity misuse with no confidentiality or availability effect, and exploitation requires that a deployed site actually use the affected frequency-control feature; the precise trigger is not described in the available sources. No public exploit is identified at time of analysis, EPSS is 0.15% (4th percentile), the vuln.today priority label is this_month, and a vendor patch is available.
RemediationAI
Patch status: Patch available per vendor advisory. Apply the vendor update referenced in the Drupal security advisory at https://www.drupal.org/sa-contrib-2026-171; the provided data states that a vendor patch is available but does not list the exact fixed version, so confirm the corrected release in the advisory before upgrading. The available sources do not document specific workarounds or compensating controls. Exposure is limited to sites running Webform 0.0.0 through 6.2.12 or 6.3.0 through 6.3.1 with a form that relies on the affected interaction-frequency control, so reviewing deployments for such forms helps scope urgency; the vuln.today priority label is this_month.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Drupal Webform contributed module, identified by CPE cpe:2.3:a:drupal:webform:*:*:*:*:*:*:*:*, with ENISA EUVD ID EUVD-2026-107830. CWE-799 (Improper Control of Interaction Frequency) is the root-cause class: the module is intended to limit how often an interaction such as a form submission can occur, and the flaw allows that control to be bypassed or otherwise misused. Per the assessed CVSS 3.1 vector, the issue is network-reachable with low attack complexity, no privileges, and no user interaction (AV:N/AC:L/PR:N/UI:N), scope unchanged, and impact limited to low integrity (C:N/I:L/A:N), for a base score of 5.3. The description and EUVD list affected ranges spanning 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1; EUVD renders these as Webform 6.3.0 <6.3.1 and 0.0.0 <6.2.12. The specific condition that defeats the frequency control is not described in the available sources. The input metadata tags the issue Information Disclosure, Drupal, and Webform, but the assessed vector records no confidentiality impact (C:N), so the tag should not be read as evidence of data exposure.
Know when Webform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Publicly reachable forms give AV:N/AC:L/PR:N/UI:N; bypassing a frequency limit is a Low integrity impact with no confidentiality or availability effect.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
3DescriptionCVE.org
Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB