CVE-2026-96372: CWE-1220 Insufficient Granularity of Access Control in Drupal Webform

The vulnerability identified as CVE-2026-96372 in the Drupal Webform module is classified under CWE-1220 (Insufficient Granularity of Access Control). It permits forceful browsing, meaning attackers can potentially bypass intended access restrictions to view or interact with resources they are not authorized to access. The affected versions include all releases from 0.0.0 up to 6.2.12 (exclusive) and from 6.3.0 up to 6.3.1 (exclusive). No CVSS score or detailed exploit information is provided, and no known exploits are reported in the wild.

The impact of this vulnerability is unauthorized access to restricted webform resources or pages due to insufficiently granular access control. This could lead to exposure of sensitive data or unauthorized actions within the Webform module. However, no active exploitation has been reported, and the exact scope of impact depends on the deployment and configuration of the affected Drupal Webform versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided in the input data, users should monitor Drupal's official security advisories for updates. Until a fix is available, consider restricting access to Webform resources through other access control mechanisms or limiting exposure to trusted users only.