DRUPAL-CONTRIB-2026-171
The advisory, in context
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.
The Webform Share submodule can expose a webform for embedding on another site.
Under certain circumstances, submissions for an Ajax-enabled Webform using Webform Share can bypass anti-spam protections.
This vulnerability is mitigated by the fact that Webform Share must be enabled, sharing must be enabled for the affected webform, and the affected webform must rely on compatible Form-API-based anti-spam protections such as Honeypot or Antibot.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 6.2.12
Fixed in 6.2.12
From 6.3.0 before 6.3.1
Fixed in 6.3.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.2.12"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": "<6.2.12"
}
},
{
"events": [
{
"introduced": "6.3.0"
},
{
"fixed": "6.3.1"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": ">=6.3.0 <6.3.1"
}
}
],
"versions": []
}