{"field_issue_status":"7","field_project":{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/7404","id":"7404","resource":"node","machine_name":"webform"},"field_sa_advisory_id":"174","field_sa_coordinated_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/akalata\u0022 rel=\u0022nofollow\u0022\u003ESwan Kalata (akalata)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/bramdriesen\u0022 rel=\u0022nofollow\u0022\u003EBram Driesen (bramdriesen)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/cilefen\u0022 rel=\u0022nofollow\u0022\u003Ecilefen  (cilefen)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/greggles\u0022 rel=\u0022nofollow\u0022\u003EGreg Knaddison (greggles)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/larowlan\u0022 rel=\u0022nofollow\u0022\u003ELee Rowlands (larowlan)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/poker10\u0022 rel=\u0022nofollow\u0022\u003EJuraj Nemec (poker10)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/xjm\u0022 rel=\u0022nofollow\u0022\u003EJess  (xjm)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_criticality":"AC:Basic\/A:None\/CI:Some\/II:None\/E:Theoretical\/TD:Uncommon","field_sa_description":{"value":"\u003Cp\u003EThe Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.\u003C\/p\u003E\n\u003Cp\u003EWebform did not sufficiently guard user-specific access rules against a malformed saved configuration. Under certain site-specific conditions, an access rule intended to grant submission access only to selected user accounts could also grant access to anonymous users.\u003C\/p\u003E\n\u003Cp\u003EThis vulnerability is mitigated by the fact that the bypass depends on malformed saved access-rule configuration.\u003C\/p\u003E","format":"1"},"field_sa_fixed_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/jrockowitz\u0022 rel=\u0022nofollow\u0022\u003EJacob Rockowitz (jrockowitz)\u003C\/a\u003E\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/liam-morland\u0022 rel=\u0022nofollow\u0022\u003ELiam Morland (liam morland)\u003C\/a\u003E\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_reported_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/acbramley\u0022 rel=\u0022nofollow\u0022\u003EAdam Bramley (acbramley)\u003C\/a\u003E\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/enyug\u0022 rel=\u0022nofollow\u0022\u003Eenyug\u003C\/a\u003E\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_solution":{"value":"\u003Cp\u003EInstall the latest version:\u003C\/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EIf you use the 6.2.x branch of Webform upgrade to \u003Ca href=\u0022\/project\/webform\/releases\/6.2.12\u0022 rel=\u0022nofollow\u0022\u003EWebform 6.2.12\u003C\/a\u003E.\u003C\/li\u003E\n\u003Cli\u003EIf you use the 6.3.x branch of Webform, upgrade to \u003Ca href=\u0022\/project\/webform\/releases\/6.3.1\u0022 rel=\u0022nofollow\u0022\u003EWebform 6.3.1\u003C\/a\u003E.\u003C\/li\u003E\n\u003C\/ul\u003E","format":"1"},"field_sa_type":"Access bypass","field_issue_last_status_change":"1790181933","field_sa_cve":["CVE-2026-96356"],"field_is_psa":"0","field_affected_versions":"\u003C6.2.12 || \u003E=6.3.0 \u003C6.3.1","field_fixed_in":[{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3625365","id":"3625365","resource":"node"},{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3625366","id":"3625366","resource":"node"}],"nid":"3597025","vid":"14500358","is_new":false,"type":"sa","title":"Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174","language":"en","url":"https:\/\/www.drupal.org\/sa-contrib-2026-174","edit_url":"https:\/\/www.drupal.org\/node\/3597025\/edit","status":"1","promote":"0","sticky":"0","created":"1790180841","changed":"1790181933","author":{"uri":"https:\/\/www.drupal.org\/api-d7\/user\/406161","id":"406161","resource":"user"},"comment":"0","comments":[{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16760981","id":16760981,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16760982","id":16760982,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16760983","id":16760983,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16760984","id":16760984,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16760985","id":16760985,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16760986","id":16760986,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16760987","id":16760987,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16760988","id":16760988,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16779446","id":16779446,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16780750","id":16780750,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16781853","id":16781853,"resource":"comment"}],"comment_count":0,"comment_count_new":false,"body":[],"feeds_item_guid":null,"feeds_item_url":null,"feed_nid":null,"flag_flag_tracker_follow_user":[],"flag_tracker_follower_count":null,"has_new_content":null,"last_comment_timestamp":"1790180841","sa_risk":[11,"Moderately critical"],"sa_id":"SA-CONTRIB-2026-174"}