Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities by civiform

    CVE-2026-107856 (GCVE-0-2026-107856)

    Vulnerability from nvd – Published: 2026-10-09 20:32 – Updated: 2026-10-09 20:32
    VLAI
    Title
    CiviForm: Trusted-Intermediary IDOR discloses any citizen's name and email
    Summary
    CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditClientForm performs a raw lookupAccount(accountId) without confirming that the citizen account belongs to the requester's trustedIntermediaryGroup. An authenticated Trusted Intermediary can enumerate accountId values and read the applicant display name, including the citizen's name and email address, for accounts outside the intermediary's group. This issue is fixed in version 3.33.0.
    Severity
    4.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
    CWE
    • CWE-639 - Authorization Bypass Through User-Controlled Key
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7592 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    civiform civiform Affected: < 3.33.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "civiform",
          "vendor": "civiform",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.33.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditClientForm performs a raw lookupAccount(accountId) without confirming that the citizen account belongs to the requester\u0027s trustedIntermediaryGroup. An authenticated Trusted Intermediary can enumerate accountId values and read the applicant display name, including the citizen\u0027s name and email address, for accounts outside the intermediary\u0027s group. This issue is fixed in version 3.33.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T20:32:10.885Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/civiform/civiform/security/advisories/GHSA-qv7c-9hjr-9rv7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/civiform/civiform/security/advisories/GHSA-qv7c-9hjr-9rv7"
        },
        {
          "name": "https://github.com/civiform/civiform/pull/13635",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/civiform/civiform/pull/13635"
        },
        {
          "name": "https://github.com/civiform/civiform/commit/ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/civiform/civiform/commit/ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e"
        },
        {
          "name": "https://github.com/civiform/civiform/releases/tag/v3.33.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/civiform/civiform/releases/tag/v3.33.0"
        }
      ],
      "source": {
        "advisory": "GHSA-qv7c-9hjr-9rv7",
        "discovery": "UNKNOWN"
      },
      "title": "CiviForm: Trusted-Intermediary IDOR discloses any citizen\u0027s name and email"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107856",
    "datePublished": "2026-10-09T20:32:10.885Z",
    "dateReserved": "2026-10-08T22:34:49.292Z",
    "dateUpdated": "2026-10-09T20:32:10.885Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-107856 (GCVE-0-2026-107856)

    Vulnerability from cvelistv5 – Published: 2026-10-09 20:32 – Updated: 2026-10-09 20:32
    VLAI
    Title
    CiviForm: Trusted-Intermediary IDOR discloses any citizen's name and email
    Summary
    CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditClientForm performs a raw lookupAccount(accountId) without confirming that the citizen account belongs to the requester's trustedIntermediaryGroup. An authenticated Trusted Intermediary can enumerate accountId values and read the applicant display name, including the citizen's name and email address, for accounts outside the intermediary's group. This issue is fixed in version 3.33.0.
    Severity
    4.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
    CWE
    • CWE-639 - Authorization Bypass Through User-Controlled Key
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7592 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    civiform civiform Affected: < 3.33.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "civiform",
          "vendor": "civiform",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.33.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditClientForm performs a raw lookupAccount(accountId) without confirming that the citizen account belongs to the requester\u0027s trustedIntermediaryGroup. An authenticated Trusted Intermediary can enumerate accountId values and read the applicant display name, including the citizen\u0027s name and email address, for accounts outside the intermediary\u0027s group. This issue is fixed in version 3.33.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T20:32:10.885Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/civiform/civiform/security/advisories/GHSA-qv7c-9hjr-9rv7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/civiform/civiform/security/advisories/GHSA-qv7c-9hjr-9rv7"
        },
        {
          "name": "https://github.com/civiform/civiform/pull/13635",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/civiform/civiform/pull/13635"
        },
        {
          "name": "https://github.com/civiform/civiform/commit/ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/civiform/civiform/commit/ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e"
        },
        {
          "name": "https://github.com/civiform/civiform/releases/tag/v3.33.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/civiform/civiform/releases/tag/v3.33.0"
        }
      ],
      "source": {
        "advisory": "GHSA-qv7c-9hjr-9rv7",
        "discovery": "UNKNOWN"
      },
      "title": "CiviForm: Trusted-Intermediary IDOR discloses any citizen\u0027s name and email"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107856",
    "datePublished": "2026-10-09T20:32:10.885Z",
    "dateReserved": "2026-10-08T22:34:49.292Z",
    "dateUpdated": "2026-10-09T20:32:10.885Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}