EUVD-2026-107834
GHSA-fxc7-249w-rxvp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged Drupal user
-
ExploitEnumerate/guess restricted webform URLs
-
ExecutionForcefully browse past access checks
-
ImpactRead or alter unauthorized webform data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Insufficient granularity of access control
|
| Exploitation Conditions | Exploitation requires an authenticated account on the target site (CVSS PR:L - a low-privileged but valid user), a Drupal installation with the Webform module at an affected version (0.0.0 through before 6.2.12, or 6.3.0 before 6.3.1), and the attacker directly requesting webform resources whose authorization is insufficiently granular (forceful browsing). No user interaction is required (UI:N) and the vector is network-reachable (AV:N). The primary limiting factors are: valid authentication is mandatory (anonymous/unauthenticated users are not in scope per PR:L), impact is confined to partial confidentiality and integrity with no availability effect, and the specific feature or endpoint that must be present to abuse is not detailed in the available sources, so applicability may depend on which Webform features are configured. |
| Impact | This is a moderate-severity access-control flaw (CWE-1220, Insufficient Granularity of Access Control enabling Forceful Browsing) carrying a vendor/NVD CVSS 3.1 base of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). The signals are internally consistent and point to a real-but-not-urgent issue rather than a high-impact emergency: the CVSS vector indicates network-reachable, low-complexity exploitation but requires authenticated low privileges (PR:L), and impact is limited to partial confidentiality and integrity with no availability effect. EPSS is low at 0.20% (9th percentile), the CVE is NOT on CISA KEV, and no exploit or PoC reference is provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_month', aligning with a planned-patch posture rather than act_now/emergency. No SSVC decision string (automatable/technical impact) was supplied, so that framework cannot be cross-referenced. Overall the signals agree: a legitimate authorization weakness worth patching on a normal monthly cycle, not a high-CVSS-but-illusory issue, but also not a drop-everything priority given the authentication requirement, partial impact, and low EPSS with no exploitation evidence. |
| Exploit ScenarioDerived | An authenticated low-privileged user of a Drupal site running the Webform module directly requests webform resources or submission URLs that should be gated by finer-grained access checks, and because access control is insufficiently granular they view or partially modify data they are not authorized to reach. No special user interaction or elevated privileges are needed beyond holding a valid low-level account. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
Forceful browsing in the Drupal contributed Webform module lets a low-privileged authenticated user reach webform resources that are not protected by sufficiently granular access checks, yielding partial confidentiality and integrity impact with no availability effect. The flaw affects Webform releases from 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1 (EUVD narrows the ranges to before 6.2.12 and before 6.3.1), and is scored 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) per the vendor/NVD vector. Exploitation requires a valid low-privileged account on the target site, no user interaction, and network reachability; EPSS is low at 0.20% (9th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis, with priority classified as this_month.
RemediationAI
Patch available per vendor advisory: consult Drupal Security Advisory SA-CONTRIB-2026-167 (https://www.drupal.org/sa-contrib-2026-167) and update the Webform module to the fixed release for your branch, which the version ranges imply are 6.2.12 and 6.3.1 - verify the exact fixed release in the advisory before upgrading, since the CVE description lists those versions inside the affected ranges while EUVD treats them as the range boundaries. No workarounds or compensating controls are described in the available sources, so updating is the primary and complete fix. Because exploitation requires an authenticated low-privileged account (PR:L) and no user interaction, reducing exposure in the interim means reviewing which roles hold accounts and Webform-related permissions on affected sites and removing access from users who do not need it - a measure that limits the attacker population but does not address the underlying insufficiently granular access checks and will affect legitimate form editors and submitters.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Webform, a contributed Drupal module that provides form-building and submission handling on top of Drupal's node/entity and routing system. The root cause class is CWE-1220, Insufficient Granularity of Access Control - the module's authorization checks are not applied at a fine enough level for individual webform resources, so an attacker who already holds a low-privileged authenticated session can perform forceful browsing: directly requesting internal paths or resources rather than navigating to them through the interfaces where access was intended to be constrained. This maps to the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, where PR:L confirms the attacker must be authenticated but need not be privileged, UI:N confirms no victim interaction is needed, and the unchanged scope with low confidentiality and integrity impact confirms the exposure is bounded rather than a full site takeover. The specific feature, route or configuration that must be present to abuse the weakness is not described in the available sources, so applicability may depend on which Webform features a site has enabled. The CPE cpe:2.3:a:drupal:webform:*:*:*:*:*:*:*:* identifies the module as the affected product.
Know when Webform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-reachable with low complexity but requires a valid low-privileged account (PR:L); forceful browsing yields partial read and limited write, so C:L/I:L and A:N.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
2DescriptionCVE.org
Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB