Drupal Webform CVE-2026-96398

Requires an authenticated session on the target Drupal site (CVSS PR:L) and that the site runs the Webform module at a vulnerable version (0.0.0-6.2.12 or 6.3.0-6.3.1). The flaw is an incorrect authorization check that permits forceful browsing - an authenticated user directly requesting a resource URL that should be access-controlled. The specific Webform feature, resource path, or configuration that is left exposed is not described in the available sources. Limiting factors: exploitation needs valid low-privilege authentication (not anonymous), impact is confined to limited confidentiality disclosure (C:L; no integrity or availability effect), and sites on patched versions 6.2.12 or 6.3.1 are not affected.

This is a moderate-severity information-exposure issue, not an emergency. The CVSS 3.1 base score is 4.3 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, meaning a network-reachable but authenticated (PR:L) low-privileged user can trigger it with low complexity, yielding only limited confidentiality impact and no integrity or availability impact. Supporting signals align with low real-world urgency: EPSS is 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit or PoC reference is present in the supplied data. The vuln.today decision label is 'this_month', consistent with a prioritize-but-not-drop-everything posture. No SSVC decision points (exploitation/automatable/technical-impact) were supplied, so that framework cannot be cross-referenced here. The signals are internally consistent - low EPSS, no KEV, no PoC, and a limited-impact CVSS vector all point the same direction. The main caveat is that the description ('Incorrect Authorization allows Forceful Browsing') does not state which resources or data become accessible, so the concrete confidentiality impact cannot be verified beyond the CVSS C:L rating.

An authenticated low-privileged user (e.g., a basic authenticated account on a Drupal site running the Webform module) directly requests webform URLs or submission endpoints that should be access-restricted, and the incorrect authorization check fails to block them, exposing form data or submissions they should not see. No public exploit code or PoC reference was provided for this CVE, and the exploit requires valid authentication (PR:L) over the network with low complexity.