Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. (CVE-2026-96373)

CVE-2026-96373 describes an incorrect authorization vulnerability in the Drupal Webform module that permits forceful browsing. This means an attacker with certain privileges might access resources or pages they should not be authorized to view. The affected versions are from 0.0.0 up to 6.2.12 and from 6.3.0 up to 6.3.1. The CVSS 3.1 vector indicates the attack requires network access, high attack complexity, privileges, and no user interaction, with low confidentiality and integrity impact and no availability impact.

The vulnerability allows unauthorized access to certain webform resources through forceful browsing, potentially exposing sensitive information or allowing limited unauthorized actions. However, the low CVSS score and required privileges reduce the overall risk. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the Drupal Webform module to trusted users and monitor for unusual access patterns consistent with forceful browsing attempts.