CVE-2026-96363

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-96363
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96363.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-96363
Aliases
Published
2026-10-22T01:21:44Z
Modified
2026-10-22T10:45:31Z
Summary
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161
Details

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

Database specific 
{
    "cna_assigner":  "drupal",
    "cwe_ids":  [
        "CWE-267"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96363.json"
}
References

Affected packages

Git / git.drupalcode.org/project/webform

Affected ranges

Type
GIT
Repo
https://git.drupalcode.org/project/webform
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2260bf0af45a003bb30caff899e76b1b3b250319
Introduced
7ec7703769bb3d4fe87207c6765aaa3faafb0bd5
Fixed
55fa7a9d6cfe1f9be07a9ab95dada21d70900f76
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0.0.0"
                },
                {
                    "fixed":  "6.2.12"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "6.3.0"
                },
                {
                    "fixed":  "6.3.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

6.*
6.0.0
6.0.0-alpha-3
6.0.0-alpha-4
6.0.0-alpha1
6.0.0-alpha10
6.0.0-alpha11
6.0.0-alpha12
6.0.0-alpha13
6.0.0-alpha14
6.0.0-alpha15
6.0.0-alpha16
6.0.0-alpha17
6.0.0-alpha18
6.0.0-alpha19
6.0.0-alpha2
6.0.0-alpha20
6.0.0-alpha21
6.0.0-alpha3
6.0.0-alpha4
6.0.0-alpha5
6.0.0-alpha6
6.0.0-alpha7
6.0.0-alpha8
6.0.0-alpha9
6.0.0-beta1
6.0.0-beta2
6.0.0-beta3
6.0.1
6.0.3
6.0.4
6.1.0
6.1.0-beta1
6.1.0-beta2
6.1.1
6.1.2
6.2.0
6.2.0-beta1
6.2.0-beta2
6.2.0-beta3
6.2.0-beta4
6.2.0-beta5
6.2.0-beta6
6.2.0-beta7
6.2.0-rc1
6.2.0-rc2
6.2.0-rc3
6.2.0-rc4
6.2.1
6.2.10
6.2.10-beta1
6.2.10-rc1
6.2.10-rc2
6.2.10-rc3
6.2.11
6.2.11-rc1
6.2.11-rc2
6.2.2
6.2.4
6.2.4-rc1
6.2.5
6.2.7
6.2.8
6.2.9
6.x-2.0-beta1
6.x-3.0
6.x-3.0-beta1
6.x-3.0-beta2
7.*
7.x-3.0-beta2
7.x-3.0-beta3
7.x-3.0-beta4
7.x-3.0-beta5
7.x-3.0-beta6
7.x-3.0-beta7
7.x-3.0-beta8
7.x-3.11
7.x-3.12
7.x-3.15
7.x-3.16
7.x-3.17
7.x-3.18
7.x-3.3-beta1
7.x-3.4-beta1
7.x-3.7
7.x-3.9
7.x-4.0
7.x-4.0-alpha1
7.x-4.0-alpha10
7.x-4.0-alpha2
7.x-4.0-alpha3
7.x-4.0-alpha4
7.x-4.0-alpha5
7.x-4.0-alpha6
7.x-4.0-alpha7
7.x-4.0-alpha8
7.x-4.0-alpha9
7.x-4.0-beta1
7.x-4.0-beta2
7.x-4.0-beta3
7.x-4.0-rc1
7.x-4.0-rc2
7.x-4.0-rc3
7.x-4.0-rc4
7.x-4.0-rc5
7.x-4.0-rc6
7.x-4.1
7.x-4.10
7.x-4.11
7.x-4.12
7.x-4.13
7.x-4.14
7.x-4.2
7.x-4.3
7.x-4.4
7.x-4.5
7.x-4.6
7.x-4.7
7.x-4.8
7.x-4.9
8.*
8.x-5.0
8.x-5.0-beta1
8.x-5.0-beta10
8.x-5.0-beta11
8.x-5.0-beta12
8.x-5.0-beta13
8.x-5.0-beta14
8.x-5.0-beta15
8.x-5.0-beta16
8.x-5.0-beta17
8.x-5.0-beta18
8.x-5.0-beta19
8.x-5.0-beta2
8.x-5.0-beta20
8.x-5.0-beta21
8.x-5.0-beta22
8.x-5.0-beta23
8.x-5.0-beta25
8.x-5.0-beta3
8.x-5.0-beta4
8.x-5.0-beta5
8.x-5.0-beta6
8.x-5.0-beta7
8.x-5.0-beta8
8.x-5.0-beta9
8.x-5.0-rc1
8.x-5.0-rc10
8.x-5.0-rc11
8.x-5.0-rc12
8.x-5.0-rc13
8.x-5.0-rc14
8.x-5.0-rc15
8.x-5.0-rc16
8.x-5.0-rc17
8.x-5.0-rc18
8.x-5.0-rc19
8.x-5.0-rc2
8.x-5.0-rc20
8.x-5.0-rc21
8.x-5.0-rc22
8.x-5.0-rc23
8.x-5.0-rc24
8.x-5.0-rc25
8.x-5.0-rc26
8.x-5.0-rc27
8.x-5.0-rc28
8.x-5.0-rc29
8.x-5.0-rc3
8.x-5.0-rc30
8.x-5.0-rc31
8.x-5.0-rc4
8.x-5.0-rc5
8.x-5.0-rc6
8.x-5.0-rc7
8.x-5.0-rc8
8.x-5.0-rc9
8.x-5.1
8.x-5.10
8.x-5.13
8.x-5.14-beta1
8.x-5.14-beta2
8.x-5.2
8.x-5.2-beta1
8.x-5.2-rc1
8.x-5.2-rc2
8.x-5.2-rc3
8.x-5.3
8.x-5.3-beta1
8.x-5.3-beta2
8.x-5.3-beta3
8.x-5.3-rc1
8.x-5.3-rc2
8.x-5.3-rc3
8.x-5.4
8.x-5.4-beta1
8.x-5.5-beta1
8.x-5.5-beta2
8.x-5.6
8.x-5.6-beta1
8.x-5.7
8.x-5.7-beta1
8.x-5.7.beta1
8.x-5.9
8.x-5.9-beta1
8.x-5.9-beta2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96363.json"