PT-2026-24717 · Git+2 · Open Forms

Bram Bolscher · Publicado 2026-03-11 · Atualizado 2026-03-15 · CVE-2026-28803

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open Forms versions prior to 3.3.13 Open Forms versions prior to 3.4.5

Description Open Forms allows users to create and publish smart forms. Prior to versions 3.3.13 and 3.4.5, a cosigner receives an email with instructions or a deep-link to start the cosigning process. The submission reference is communicated, allowing the user to retrieve the submission for cosigning. An attacker can guess or modify the received code to access arbitrary submissions after logging in with DigiD/eHerkenning, or similar authentication methods, depending on the form configuration. The issue involves the potential to access submissions not intended for the cosigner.

Recommendations Update Open Forms to version 3.3.13 or later. Update Open Forms to version 3.4.5 or later.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2026-28803

GHSA-2G49-RFM6-5QJ5

Produtos afetados

Open Forms

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28803.json · Exploit
• https://github.com/open-formulieren/open-forms/security/advisories/GHSA-2g49-rfm6-5qj5 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-28803 · Nota de Segurança
• https://twitter.com/CVEnew/status/2032998324043685973 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-28803 · Aviso do Fabricante