CVE-2026-96372
NoneCVSS
—
EPSS
0.2%
Published
Oct 22, 2026
CISA due date
—
The record
Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-78230 AshAi exposes Ash read actions to language-model tool calls. CWE-1220
- CVE-2026-78216 AshLua exposes Ash read actions to Lua scripts run through an eval action. CWE-1220
- CVE-2026-15431 A potential security vulnerability has been identified in the HP Support Assistant for… CWE-1220
- CVE-2026-40145 A vulnerability exists in the interaction between a Endpoint Privilege Management… CWE-1220
- CVE-2025-31938 Insufficient granularity of access control in some subsystem for some Intel(R) Xeon(R) 6… CWE-1220
- CVE-2026-50502 Insufficient granularity of access control in Windows Event Logging Service allows an… CWE-1220
- CVE-2026-50405 Insufficient granularity of access control in Windows Filtering Platform (WFP) allows an… CWE-1220
- CVE-2026-56155 Insufficient granularity of access control in Active Directory Federation Services (AD… CWE-1220