Drupal Webform can expose sensitive information that is stored in the browser cache because the access control settings are incorrectly configured. An attacker who can access the user environment where the cached data resides may view or copy confidential data. The vulnerability does not affect code execution or the entire system, but it enables data disclosure when user permissions are not properly enforced.

Drupal Webform is affected for all releases between 0.0.0 and 6.2.12 and from 6.3.0 to 6.3.1. The issue applies to the standard community builds of the module and does not limit the number of installations or deployment layers.

The CVSS score is 3.1 and the EPSS score is < 1%, indicating a low publicly verified exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need at least local access to the victim’s browser session where the cached form data resides, or would rely on social engineering to prompt the user to view the cached content. The official CWE‑525 classification highlights that incorrect caching configuration can lead to information disclosure, and the exploit is constrained to the confidentiality of the cached data. Code execution or broader system compromise is not possible through this vulnerability.