What’s Vulnerable › Vulnerabilities

CVE-2026-107856: CiviForm: Trusted-Intermediary IDOR discloses any citizen's name and email

• Severity: medium (CVSS 4.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-09 · updated 2026-10-16
• Weakness: CWE-639

Description

CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditClientForm performs a raw lookupAccount(accountId) without confirming that the citizen account belongs to the requester's trustedIntermediaryGroup. An authenticated Trusted Intermediary can enumerate accountId values and read the applicant display name, including the citizen's name and email address, for accounts outside the intermediary's group. This issue is fixed in version 3.33.0.

Affected products

• civiform: before 3.33.0

References

• https://github.com/civiform/civiform/commit/ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e
• https://github.com/civiform/civiform/pull/13635
• https://github.com/civiform/civiform/releases/tag/v3.33.0
• https://github.com/civiform/civiform/security/advisories/GHSA-qv7c-9hjr-9rv7

Get alerted when CVE-2026-107856 or the next vulnerability affects your stack