EUVD-2026-107836
GHSA-ppjw-xgvp-2p32
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
ExploitAccess Webform page caching sensitive data
-
ImpactRetrieve retained data from browser/web cache
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security Browser cache control
|
| Exploitation Conditions | Exploitation requires that a low-privileged authenticated user (PR:L) be able to reach Webform-rendered content whose sensitive data is stored in the browser or web cache under an incorrectly configured access-control / cache-control level (CWE-525); the specific Webform feature, form configuration, or cache setting that triggers the retention is not described in the available sources. Limiting factors: authentication is required (PR:L, so not anonymous/remote-unauthenticated), attack complexity is high (AC:H), impact is confined to limited confidentiality disclosure (C:L; no integrity or availability impact), and practical exploitation typically depends on a second party gaining access to the retained cache (e.g., a shared or non-private device). Applies to Webform 0.0.0-6.2.12 and 6.3.0-6.3.1; updating to 6.2.12 or 6.3.1 remediates it. |
| Impact | This is a low-severity, low-priority issue and the signals are consistent, not conflicting. The input CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N, base 3.1) indicates a network-reachable flaw that nonetheless requires low-level authentication (PR:L) and has high attack complexity (AC:H), with only limited confidentiality impact and no integrity or availability impact - fitting CWE-525 (sensitive information retained in web/browser cache). EPSS reinforces low urgency at 0.19% (8th percentile), and the vuln.today Decision label is 'monitor'. There is no CISA KEV listing in the input, so this is not confirmed as actively exploited, and no public exploit or PoC reference beyond the vendor advisory is provided - status is 'no public exploit identified at time of analysis'. No SSVC decision breakdown (automatable/technical-impact) was supplied beyond the 'monitor' label. Net: a genuine but minor information-disclosure hygiene issue, not an emergency; the low CVSS, low EPSS, AC:H, and 'monitor' label all agree. |
| Exploit ScenarioDerived | An authenticated low-privilege user interacts with a Webform-driven page on a Drupal site, and sensitive form-related data is written to the browser (or shared/web) cache without adequate cache-control restrictions. A subsequent party with access to that cache - for example on a shared or kiosk workstation - could read the retained data. No public PoC is provided, and the high attack complexity (AC:H) limits reliable exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
Drupal's Webform contributed module can retain sensitive submitted form data in the browser cache, leaving it recoverable by a later user of the same browser profile on versions prior to 6.2.12 and 6.3.1. Exploitation requires a low-privileged authenticated user (PR:L) to reach Webform-rendered content whose access-control and cache-control settings are misconfigured, and the assessed vector rates attack complexity as high with only limited confidentiality impact (CVSS 3.1 base score 3.1). There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is 0.19% (8th percentile) and the vuln.today priority is monitor, consistent with a low-severity, low-urgency disclosure.
RemediationAI
Vendor-released patch: update the Webform module to 6.2.12 for the 6.2.x and earlier branches, or to 6.3.1 for the 6.3.x branch, per Drupal Security Advisory SA-CONTRIB-2026-165 (https://www.drupal.org/sa-contrib-2026-165). No vendor-documented workaround is described in the available sources, so upgrading is the complete fix; if the update must be staged, exposure is bounded by the assessed preconditions, so limit which low-privileged accounts can reach Webform-rendered content carrying sensitive values and avoid exposing such forms on shared or non-private devices, since the retained cache is only useful to an attacker who later gains access to that browser profile. Note that these are risk-reduction measures derived from the assessed prerequisites rather than a vendor-issued mitigation, and that EPSS (0.19%, 8th percentile), the absence of KEV listing and the 'monitor' priority indicate this can be scheduled with normal module maintenance rather than handled as an emergency.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-525, Use of Web Browser Cache Containing Sensitive Information: content rendered by the Webform module is served without cache directives that prevent a browser (or intermediary cache) from storing it locally, so sensitive field values can persist in the browser cache and be re-read afterwards. CWE-525 is fundamentally an access-control/configuration weakness rather than a memory-safety or injection flaw, which is why the disclosure is classified under 'Exploiting Incorrectly Configured Access Control Security Levels'. The affected code is the Drupal contributed module identified by CPE cpe:2.3:a:drupal:webform, layered on the Drupal core caching and page-render pipeline; the specific Webform feature, form configuration, or cache setting that triggers the retention is not described in the available sources. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N confirms network reachability, high attack complexity, a low-privileged authenticated actor, no user interaction beyond that actor's own browsing, and impact limited to confidentiality with no integrity or availability effect.
Know when Webform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Authenticated low-privilege access is needed (PR:L) and reliable cache exposure is not guaranteed (AC:H); only limited sensitive data is disclosed, so C:L with no integrity or availability impact.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
2DescriptionCVE.org
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB