Drupal Webform CVE-2026-96373

The description names no specific Webform feature, protocol, or configuration setting as a prerequisite, so the exact precondition is not stated in the available sources. Per the vendor CVSS vector, exploitation requires high privileges (PR:H) and high attack complexity (AC:H) with no user interaction (UI:N), meaning an authenticated, already-privileged Drupal account rather than an anonymous visitor. Exploitation is limited to Webform versions 0.0.0-6.2.12 and 6.3.0-6.3.1; sites on 6.2.12 or 6.3.1+ are not affected. The high privilege and complexity requirements, plus the limited C:L/I:L impact, materially constrain realistic risk below the network-reachable vector alone.

All signals point to low real-world priority. The vendor CVSS is 3.3 (Low) driven by AV:N but tempered by AC:H, PR:H, and only partial confidentiality/integrity impact (C:L/I:L/A:N) with no scope change - i.e. a high-privileged, authenticated user abusing an authorization gap rather than a remote-unauthenticated break. EPSS agrees: 0.18% (7th percentile), indicating very low likelihood of near-term exploitation. The vuln.today decision label is 'monitor', not act_now/emergency. This is NOT in CISA KEV (no confirmed active exploitation), and there is no public exploit identified at time of analysis - the only linked Drupal reference is the vendor security advisory, not working exploit code. The one tension to flag: the input tag 'Authentication Bypass' is imprecise - the CWE (CWE-863 Incorrect Authorization) and the description ('Forceful Browsing') describe an authorization/access-control gap, not an authentication bypass; this does not change severity but matters for categorization. Net: a genuine low-severity authorization flaw, not a high-CVSS-but-low-risk inflation case, and not an urgent one.

An authenticated Drupal user with the privilege level the vendor vector assumes (PR:H) navigates directly to a Webform resource or endpoint they should not be able to reach (forceful browsing), and the incorrect authorization check fails to stop them, exposing or letting them alter limited form data (C:L/I:L). No public exploit code is identified; the precise request needed to trigger the gap is not described in the available sources.