https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 20:25:26 +0000 https://vulnerability.circl.lu/vuln/drupal-contrib-2026-165 <p><strong>Affected:</strong> Packagist:https://packages.drupal.org/8: drupal/webform</p> <p>The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.</p> <p>When Webform is used with JSON:API enabled, submissions may be cached without varying correctly by the authenticated user. If a webform is configured so that authenticated users can view their own submissions, a request to the JSON:API webform submission collection can return a cached response generated for a different user.</p> <p>This can allow an authenticated user to view another user&#39;s webform submission data through the JSON:API collection endpoint.</p> <p>This vulnerability is mitigated by the fact that JSON:API must be enabled, the affected webform must expose submissions through JSON:API, and the attacker must have an account with permission to view their own submissions for the affected webform.</p> <p><strong>Affected:</strong> Packagist:https://packages.drupal.org/8: drupal/webform</p> <p>The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.</p> <p>When Webform is used with JSON:API enabled, submissions may be cached without varying correctly by the authenticated user. If a webform is configured so that authenticated users can view their own submissions, a request to the JSON:API webform submission collection can return a cached response generated for a different user.</p> <p>This can allow an authenticated user to view another user&#39;s webform submission data through the JSON:API collection endpoint.</p> <p>This vulnerability is mitigated by the fact that JSON:API must be enabled, the affected webform must expose submissions through JSON:API, and the attacker must have an account with permission to view their own submissions for the affected webform.</p> https://vulnerability.circl.lu/vuln/drupal-contrib-2026-165