What’s Vulnerable › Vulnerabilities

CVE-2026-27198: Formwork Improperly Manages Privileges During User Creation

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-21 · updated 2026-06-17
• Weakness: CWE-269

Description

Formwork is a flat file-based Content Management System (CMS). In versions 2.0.0 through 2.3.3, the application fails to properly enforce role-based authorization during account creation. Although the system validates that the specified role exists, it does not verify whether the current user has sufficient privileges to assign highly privileged roles such as admin. As a result, an authenticated user with the editor role can create a new account with administrative privileges, leading to full administrative access and complete compromise of the CMS. This issue has been fixed in version 2.3.4.

Affected products

• getformwork formwork: from 2.0.0 before 2.3.4 — fixed in 2.3.4

How to fix

Upgrade to a fixed version: getformwork formwork 2.3.4. Check the vendor advisory for mitigations.

References

• https://github.com/getformwork/formwork/commit/19390a0b408e084bdef86f3581e050f3ee51e7cd
• https://github.com/getformwork/formwork/releases/tag/2.3.4
• https://github.com/getformwork/formwork/security/advisories/GHSA-34p4-7w83-35g2

Get alerted when CVE-2026-27198 or the next vulnerability affects your stack