CVE-2026-96369: CWE-525 Use of Web Browser Cache Containing Sensitive Information in Drupal Webform

This vulnerability (CVE-2026-96369) in the Drupal Webform module is categorized under CWE-525, which concerns the use of web browser cache containing sensitive information. The issue arises from incorrectly configured access control security levels that allow sensitive data to be cached in the browser, potentially exposing it to unauthorized parties. The affected versions are from 0.0.0 up to 6.2.12 (exclusive) and from 6.3.0 up to 6.3.1 (exclusive). There is no information about active exploitation or a vendor-provided patch in the provided data.

The impact is the potential exposure of sensitive information through the web browser cache due to improper access control configurations in the Drupal Webform module. This could lead to unauthorized access to sensitive data stored in the browser cache. No confirmed exploits in the wild are reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Drupal's official channels for updates and consider reviewing and tightening access control configurations in the Webform module to minimize sensitive data caching until a fix is available.