CVE-2026-96371: CWE-267 Privilege Defined With Unsafe Actions in Drupal Webform

The vulnerability identified as CVE-2026-96371 in the Drupal Webform module involves a privilege that is defined with unsafe actions, categorized under CWE-267. This flaw allows an attacker to perform Stored Cross-Site Scripting (XSS) attacks by exploiting the unsafe privilege configuration. The affected versions include all Webform versions from the initial release up to 6.2.12, excluding 6.2.12 itself, and versions from 6.3.0 up to 6.3.1, excluding 6.3.1. There is no information about available patches or fixes, and no known exploits in the wild have been reported.

The impact of this vulnerability is the potential for Stored XSS attacks, which can allow attackers to inject malicious scripts that execute in the context of users' browsers, potentially leading to session hijacking, defacement, or other malicious actions. The vulnerability arises from unsafe privilege definitions in the Webform module, which may allow unauthorized or unintended actions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider restricting access to the affected privileges and monitor for suspicious activity related to Webform usage. Avoid granting the vulnerable privileges to untrusted users.