PT-2026-21344 · Formwork · Formwork

G3Xar · Publicado 2026-02-19 · Atualizado 2026-03-23 · CVE-2026-27198

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Formwork versions 2.0.0 through 2.3.3

Description Formwork is a flat file-based Content Management System (CMS). The application does not properly enforce role-based authorization during account creation. Specifically, it does not verify if the current user has the necessary privileges to assign highly privileged roles, such as admin. This allows an authenticated user with the editor role to create a new account with administrative privileges, resulting in full administrative access and potential compromise of the CMS.

Recommendations Update to version 2.3.4 or later.

Exploit

Correção

LPE

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2026-27198

GHSA-34P4-7W83-35G2

Produtos afetados

Formwork

Referências · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27198.json · Exploit
• https://github.com/getformwork/formwork/security/advisories/GHSA-34p4-7w83-35g2 · Aviso do Fabricante
• https://github.com/getformwork/formwork/commit/19390a0b408e084bdef86f3581e050f3ee51e7cd · Correção
• https://github.com/getformwork/formwork · Nota
• https://github.com/getformwork/formwork/releases/tag/2.3.4 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-27198 · Nota de Segurança
• https://twitter.com/pulsepatchio/status/2025579930566680767 · Publicação no Twitter
• https://t.me/CVEtracker/45349 · Publicação no Telegram
• https://twitter.com/TheRabbitPy/status/2036209036220043688 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-27198 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2025142215375208769 · Publicação no Twitter
• https://t.me/cveNotify/152696 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-34p4-7w83-35g2 · Aviso do Fabricante
• https://reddit.com/r/VulnMatter/comments/1raarn5/resumen_diario_de_vulnerabilidades_20022026 · Publicação no Reddit
• https://twitter.com/CVEnew/status/2025154191711260809 · Publicação no Twitter