CVE-2026-96370: CWE-863 Incorrect Authorization in Drupal Webform

This vulnerability in Drupal Webform arises from improper authorization checks (CWE-863), enabling an attacker to perform Server Side Request Forgery (SSRF). The affected versions include all releases from 0.0.0 up to 6.2.12 and from 6.3.0 up to 6.3.1. The vulnerability was publicly disclosed on October 22, 2026. There is no information about known exploits in the wild or an available patch from the provided data.

Successful exploitation could allow an attacker to induce the server to make unauthorized requests to internal or external resources, potentially leading to information disclosure or interaction with internal systems. The exact impact depends on the server environment and configuration. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Drupal's official channels for updates and apply any released fixes promptly. Until a fix is available, consider restricting access to the Webform module and limiting server outbound requests as a precaution.