The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.
Impact
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.
Source excerpt · OSVThis vulnerability is mitigated by the fact that JSON:API must be enabled, the affected webform must expose submissions through JSON:API, and the attacker must have an account with permission to view their own submissions for the affected webform.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 6.2.12Ecosystem versions | 6.2.12 |
| From 6.3.0 before 6.3.1Ecosystem versions | 6.3.1 |
Version evidence: OSV · DRUPAL-CONTRIB-2026-165
View original version evidence (0 explicit versions)
Original source description
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.
When Webform is used with JSON:API enabled, submissions may be cached without varying correctly by the authenticated user. If a webform is configured so that authenticated users can view their own submissions, a request to the JSON:API webform submission collection can return a cached response generated for a different user.
This can allow an authenticated user to view another user's webform submission data through the JSON:API collection endpoint.
This vulnerability is mitigated by the fact that JSON:API must be enabled, the affected webform must expose submissions through JSON:API, and the attacker must have an account with permission to view their own submissions for the affected webform.