Read the docs
TI-2026-70290 Aliases CVE-2026-107856

Authorization bypass in CiviForm exposes citizen names and emails

Priority LOW 20CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

CiviForm before 3.33.0 has an authorization bypass (CWE-639) in the Trusted Intermediary edit client form endpoint. The showEditClientForm function looks up any citizen account by ID without checking that the account belongs to the intermediary's group. An authenticated Trusted Intermediary can enumerate account IDs and read the display name and email address of citizens outside their group.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditClientForm performs a raw lookupAccount(accountId) without confirming that the citizen account belongs to the requester's trustedIntermediaryGroup. An authenticated Trusted Intermediary can enumerate accountId values and read the applicant display name, including the citizen's name and email address, for accounts outside the intermediary's group. This issue is fixed in version 3.33.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00233 14th percentileScored 2026-11-07
Fix Fixed civiform (civiform): 3.33.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
civiformciviformbefore 3.33.03.33.0Patch availableCNA
  • civiform Vendorciviform Affected before 3.33.0 Fixed in 3.33.0 Patch available CNA

Remediation

Upgrade CiviForm to version 3.33.0, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA civiform (civiform) Fixed in 3.33.0

Timeline

  1. 2026-10-10 Threatist record created from CVE-2026-107856
  2. 2026-10-13 CISA SSVC decision points changed

References

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences