CVE-2026-96367: CWE-267 Privilege Defined With Unsafe Actions in Drupal Webform

The vulnerability identified as CVE-2026-96367 in the Drupal Webform module involves a privilege defined with unsafe actions (CWE-267), which results in a stored XSS vulnerability. This flaw affects multiple versions of the Webform module, specifically versions >=0.0.0 <6.2.12 and >=6.3.0 <6.3.1. The unsafe privilege configuration allows attackers to inject and store malicious scripts that execute when accessed by users with the relevant privileges. No CVSS score is provided, and no vendor advisory or patch links are included in the data.

Successful exploitation of this vulnerability can lead to stored cross-site scripting attacks, potentially allowing attackers to execute arbitrary scripts in the context of affected users. This can result in session hijacking, defacement, or other malicious actions within the Drupal Webform environment. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Drupal's official channels for updates. Until a fix is available, review and restrict privileges related to the Webform module to minimize exposure to unsafe actions.