Drupal Webform CVE-2026-96370

Requires a valid authenticated account with at least low privileges on the target Drupal site (PR:L); it is not exploitable by fully anonymous visitors. The incorrect authorization check (CWE-863) then lets that user cause the Webform module to perform server-side requests. The specific Webform feature, submission path, or configuration that must be reachable is not described in the available sources, so it cannot be stated which non-default settings, if any, narrow exposure. Limiting factors: authentication is required, but no user interaction (UI:N) and only low attack complexity (AC:L) are needed once a foothold account exists.

This is a moderate, not emergency, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 5.4) describes a network-reachable, low-complexity flaw that requires an authenticated low-privileged account (PR:L) and yields only low confidentiality and low integrity impact with no availability impact - consistent with an SSRF that lets an attacker coerce the server into making requests but without full system compromise. The exploitation signals reinforce a measured response: EPSS is low at 0.20% (9th percentile), there is no CISA KEV listing (not actively exploited), and no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', aligning with the low-to-moderate signals rather than act_now/emergency. The main thing elevating real-world concern is the product footprint and the PR:L (rather than PR:N) requirement, which limits exploitation to users who can already authenticate. No SSVC automatable/technical-impact fields were supplied, so an automatability judgement cannot be made from the input. Net: a genuine issue warranting timely patching within the normal cycle, not a drop-everything flaw.

An attacker holding a low-privileged authenticated account on a Drupal site running a vulnerable Webform version abuses the incorrect authorization check to make the server issue attacker-directed HTTP requests (SSRF), potentially reaching internal services, cloud metadata endpoints, or otherwise unreachable hosts. Because AC:L and no user interaction are required, exploitation is reliable once the attacker is authenticated. No public exploit identified at time of analysis; only the vendor advisory is referenced.