CVE-2026-96363: CWE-267 Privilege Defined With Unsafe Actions in Drupal Webform

The vulnerability identified as CVE-2026-96363 in the Drupal Webform module involves a privilege that is defined with unsafe actions, categorized under CWE-267. This misconfiguration enables Stored XSS attacks, where malicious scripts can be stored and executed in the context of users interacting with the webform. The affected versions include all versions from 0.0.0 up to 6.2.12 (exclusive) and from 6.3.0 up to 6.3.1 (exclusive). No patch or remediation details are provided in the input data, and no active exploitation has been reported.

The impact of this vulnerability is the potential for Stored Cross-Site Scripting attacks, which can lead to the execution of arbitrary scripts in the context of affected users. This can result in session hijacking, defacement, or other malicious actions depending on the attacker's intent and the victim's privileges. Since the vulnerability arises from unsafe privilege definitions, it may allow attackers with certain privileges to perform unauthorized actions via script injection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and restrict privileges related to the Drupal Webform module to minimize exposure. Monitor Drupal's official security advisories for updates and apply patches promptly once released.