CVE-2026-107856

Name of the Vulnerable Software and Affected Versions CiviForm versions prior to 3.33.0

Description An authenticated Trusted Intermediary can enumerate accountId values to read applicant display names, including names and email addresses, for accounts that do not belong to their assigned group. This occurs because the endpoint "/admin/tiDash/editClientForm/:accountId" verifies the requester's status as a Trusted Intermediary, but the showEditClientForm() function performs a lookupAccount(accountId) without confirming if the citizen account is part of the requester's trustedIntermediaryGroup.

Recommendations Update to version 3.33.0.