CVE-2026-11578

Name of the Vulnerable Software and Affected Versions Fluent Forms versions prior to 6.2.5

Description An Insecure Direct Object Reference (IDOR) exists when the software does not properly restrict the deletion of form submission entries. This allows a user with Manager privileges, who is restricted to managing specific forms, to permanently delete submission entries belonging to forms they are not authorized to manage. This issue occurs in non-default configurations where an administrator has created at least one Manager restricted to specific forms.

Recommendations Update to version 6.2.5 or later.