If your association runs Drupal, there is a good chance every form on your site is Webform. Membership applications, event registration, abstract submission, award nominations, committee interest, contact us. One module, doing the work of a dozen integrations, on almost every association Drupal site we have ever been handed.
On September 23 the Drupal security team published a batch of contributed project advisories. A large share of them were against Webform, and one of them is rated critical.
Where this comes from. Every number and quotation below is from the advisory pages on drupal.org, read individually. Where published counts of the batch disagree with each other, we have said what we verified ourselves rather than repeating a total.
What Actually Landed
The advisory numbers from SA-CONTRIB-2026-175 through SA-CONTRIB-2026-191 all carry the date of September 23, 2026. That is at least seventeen advisories in a single day, and we have seen published counts of the batch ranging higher than that, which is why we are giving you the range we confirmed rather than a headline figure.
The critical one. The one to look at first is SA-CONTRIB-2026-175, against Webform itself. It is rated critical at 18 out of 25 and tracked as CVE-2026-96355. The advisory says Webform does not sufficiently exclude certain format templates from token replacement, and that this can allow an attacker to submit data that is evaluated as template code when a submission is rendered. Depending on configuration and which modules are enabled, the consequence is information disclosure, stored cross-site scripting, or remote code execution.
- Affected. Everything below 6.2.12, and 6.3.0.
- Fixed in. 6.2.12 on the 6.2 branch, 6.3.1 on the 6.3 branch.
- Reported by. Michael Maturi, and the fix is credited to Jacob Rockowitz and Liam Morland.
One more worth naming. Separately in the same batch, SA-CONTRIB-2026-186 covers Webform REST, rated less critical, for not sufficiently checking permission to webform and webform submission entities. If you expose form submissions over an API, that is a second thing to look at and it is a different module from Webform itself.
Read the Rating Honestly
Critical at 18 out of 25 sounds like a drop-everything number, and the advisory itself is more measured than that. We would rather you patch for the right reason.
- The exploit is rated theoretical. The advisory lists target distribution as uncommon configurations only. It requires a webform configured with a custom multiple-value item format containing submission-value tokens, which is not a default and not something most sites have.
- But where it applies, it applies completely. Where the conditions are met, authentication required is none and the confidentiality and integrity impact are both total. The score is high because the ceiling is high, not because the floor is.
What that adds up to. So the correct response is not panic. It is to find out whether you are one of the uncommon configurations, which for most associations is a question only your developer or your agency can answer by looking, and to take the update regardless because it is a point release on a module you already run.
Why This Keeps Being a Drupal Story
We wrote about the September 2 batch of contributed advisories three weeks ago and made the point that Drupal core is not where association risk sits. This batch is the same lesson with a sharper edge, because it is not ten advisories spread across ten projects. It is a large batch concentrated on one module that nearly every association Drupal site depends on.
This is not an argument against Webform. Webform is maintained seriously, by named people, with a long track record. A module that gets this many advisories in a day is usually a module getting real security attention rather than one being neglected, and that is the correct way to read it. The exposure is not that Webform is bad. The exposure is that it is load-bearing.
Stated plainly. A single contributed module handles your membership application, your event registration and your abstract submissions. It is doing the work that at a WordPress shop would be spread across three or four plugins, which is an argument in its favor architecturally and a concentration of risk operationally. Both things are true and the second one is the one with an action attached.
What a Form Module Actually Holds
Before deciding how urgent this is for your organization, it is worth being concrete about what passes through Webform on an association site, because it is more than the contact page.
- The membership application. Name, employer, job title, credentials, sometimes license numbers, sometimes demographic questions asked for program reporting. Submitted by someone who is not yet a member and has no account.
- Event registration. Dietary requirements and accessibility accommodations, which are health-adjacent information collected in a form field that nobody ever classified as sensitive.
- Abstract and award submissions. Unpublished research, author affiliations and peer review comments, held for months before anything becomes public.
- And the complaint or ethics form. Members telling you about problems, sometimes naming other members, sometimes describing conduct.
Why the inventory matters here. An information disclosure flaw in the module holding those is a different proposition from one in a contact form, and that is the frame for deciding how fast to move rather than the CVSS number on its own.
What to Do This Week
Four things, and the first two are quick:
- Find out which Webform version you run. If you are below 6.2.12 on the 6.2 branch or on 6.3.0, you are affected by the critical advisory. That is a one-line answer from your developer or from the update report in the admin interface.
- Take the update to 6.2.12 or 6.3.1. Point releases on a module this widely used are low-drama. Test on staging as you would with anything, but this is not a migration.
- Then read the rest of the batch against your module list. Seventeen advisories in a day means the Webform ones are not the only ones. Pull the full list for the date and check it against the modules you actually have installed, which is a different and shorter list than the batch.
- And check what your forms are connected to. If your forms hand off to an AMS, a payment processor or an email platform, a flaw in the form layer is a flaw in front of all of them. Worth knowing which of those connections pass through Webform before you need to know it.
The Thing Underneath All of This
A day like September 23 only costs you something if nobody at your organization reads it. There is no monitoring tool that solves this, because the work is not detecting the advisory, it is knowing which of the hundreds of published advisories apply to the specific set of modules your site runs.
Which requires one document. That is why the answer we keep giving is the boring one. A current, accurate list of every contributed module on your site and its version is the thing that converts an advisory day from an emergency into a maintenance ticket. Most associations we meet cannot produce that list, which means they cannot act on a batch like this at all, and there will be another batch.
We Will Tell You Which Ones Apply to You
Read-only access is enough. What comes back is every contributed module on your site with its installed version, which of them have open advisories against them today including this batch, which of those sit in front of member data or payments, and the fixed release for each. If nothing on your site is affected by the September 23 advisories, that is what the letter will say, and for some sites it will.
This is ongoing work rather than a project, which is why it sits inside our partnership plans. Drupal publishes advisories on a schedule, the schedule does not stop, and a module inventory taken last year tells you very little about this week.