CVE-2026-96364 can be mapped to Drupal Webform: the OSV record identifies the affected Composer package as drupal/webform. Webform Share is the submodule involved in the reported behavior, not a competing package identity. The issue is conditional on a particular combination of Webform Share, sharing, Ajax, and anti-spam configuration.
What Drupal component does CVE-2026-96364 affect?
The OSV record identifies the vulnerability as Drupal advisory database entry DRUPAL-CONTRIB-2026-171, aliases it to CVE-2026-96364, and names drupal/webform as the affected package. In Drupal project terms, that is the Webform project. The issue description specifically involves its Webform Share submodule.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Drupal 7 Webform Cookbook | $146.35 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
These names describe different levels of the same finding: Webform is the affected project/package; Webform Share is the submodule implicated in the conditions under which the issue can occur. The record does not identify a separate affected module instead of Webform.
OSV’s record gives a publication time of September 23, 2026, at 16:26:32 UTC and a modification time of 17:40:55 UTC. It links to Drupal advisory SA-CONTRIB-2026-171 and identifies the Drupal Security Team advisory-database JSON file as its import source.
#1 Best Overall
When can the anti-spam bypass occur?
The record says that, under certain circumstances, submissions to an Ajax-enabled Webform using Webform Share can bypass anti-spam protections. It describes a configuration-dependent condition, not a claim that every Webform installation—or every use of an anti-spam module—is vulnerable.
The advisory’s stated conditions involve the following combination:
- Webform Share is enabled.
- Sharing is enabled for the affected webform.
- The webform uses Ajax.
- The form relies on compatible Form-API-based anti-spam protections. Honeypot and Antibot are examples named in the record.
The record does not say that every installation of Honeypot or Antibot is affected. Their presence alone does not establish exposure; the relevant Webform Share, sharing, Ajax, and protection setup must also be considered.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhich Webform versions are listed as affected?
OSV lists two affected version ranges for drupal/webform, each with its own fixed version:
| Webform release line | Affected versions | Fixed version listed by OSV |
|---|---|---|
| 6.2 | Below 6.2.12 | 6.2.12 |
| 6.3 | 6.3.0 up to, but not including, 6.3.1 | 6.3.1 |
In its summarized range notation, OSV gives <6.2.12 || >=6.3.0 <6.3.1. The listed fixes are specific to those release lines; use the version applicable to the line installed rather than treating one fixed version as universal.
How should a site maintainer check exposure?
- Identify the installed Webform version and compare it with the affected ranges above.
- Check whether the Webform Share submodule is enabled and whether sharing is enabled on the webform in question.
- Determine whether that form uses Ajax and relies on a compatible Form-API-based anti-spam protection such as the examples in the advisory.
- If the installed package is in an affected range, update to the corresponding fixed version listed by OSV: 6.2.12 on the 6.2 line or 6.3.1 on the 6.3 line.
Why does the title’s “cannot be mapped” premise miss the record?
The apparent ambiguity comes from the advisory naming Webform Share while the package field names Webform. Those details are compatible: the package mapping is to Webform, and the described behavior involves a submodule plus specific form settings. OSV links the Drupal advisory, but the public record consulted here is that OSV entry; independent CVE.org or NVD metadata was not verified.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
