Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
CVE-2026-96364 maps to the Drupal Webform project, packaged as drupal/webform. The advisory specifically implicates its Webform Share submodule under certain configuration conditions. These are two levels of identification, not competing module mappings.
What Drupal component does CVE-2026-96364 affect?
The OSV record identifies CVE-2026-96364 as Drupal advisory DRUPAL-CONTRIB-2026-171 and names the affected Composer package as drupal/webform. Webform is a Drupal project for building forms, collecting submissions, and controlling access to forms and submission data. The vulnerability description narrows the relevant behavior to Webform Share, a submodule that can expose a webform for embedding on another site. OSV’s record links the advisory to Drupal’s SA-CONTRIB-2026-171.
So the public mapping is not “no module identified”: Webform is the affected project/package, while Webform Share is the submodule involved in the described scenario.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →When can the anti-spam protection be bypassed?
The advisory describes a conditional issue involving submissions to an Ajax-enabled Webform that is shared through Webform Share. In that setup, submissions may bypass compatible Form-API-based anti-spam protections. The record names Honeypot and Antibot as examples; it does not say that simply having either module installed makes every site vulnerable.
#1 Best Overall
- Webform Share is enabled.
- Sharing is enabled for the affected webform.
- The form uses Ajax.
- The form relies on a compatible Form-API-based anti-spam protection, such as Honeypot or Antibot.
The described conditions concern the particular shared, Ajax-enabled form and its anti-spam configuration—not every Webform installation or every use of those anti-spam modules.
Which Webform versions are affected, and what fixes them?
OSV lists two affected version lines for drupal/webform and gives a fixed version for each:
Rank #2
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
| Webform version line | Affected versions | Fixed version |
|---|---|---|
| 6.2 | Earlier than 6.2.12 | 6.2.12 |
| 6.3 | 6.3.0, but earlier than 6.3.1 | 6.3.1 |
In range notation, the affected versions are <6.2.12 || >=6.3.0 <6.3.1. Check the version line actually installed; the listed fixes are 6.2.12 and 6.3.1 on their respective lines.
What should a Drupal maintainer check?
- Check the installed Webform package version against the affected ranges above.
- Determine whether Webform Share is enabled and sharing is enabled for the form in question.
- Check whether that form uses Ajax and relies on a compatible Form-API-based anti-spam protection.
- Update to the corresponding fixed Webform version: 6.2.12 or 6.3.1, according to the version line in use.
What does the public record establish?
The OSV entry identifies itself as DRUPAL-CONTRIB-2026-171, aliases that record to CVE-2026-96364, and reports publication on 2026-09-23 and modification later that day. It points to the Drupal advisory and the Drupal Security Team’s advisory-database JSON as its import source. The mapping and version details here are based on that opened OSV record; CVE.org and NVD metadata were not independently verified for this article.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
