PT-2026-109311 · Civiform · Civiform
CVE-2026-107856
·
Published
2026-10-09
·
Updated
2026-10-13
CVSS v3.1
4.5
Medium
| Vector | AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
CiviForm versions prior to 3.33.0
Description
An authenticated Trusted Intermediary can enumerate
accountId values to read applicant display names, including names and email addresses, for accounts that do not belong to their assigned group. This occurs because the endpoint "/admin/tiDash/editClientForm/:accountId" verifies the requester's status as a Trusted Intermediary, but the showEditClientForm() function performs a lookupAccount(accountId) without confirming if the citizen account is part of the requester's trustedIntermediaryGroup.Recommendations
Update to version 3.33.0.
Exploit
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Civiform