PT-2026-21344 · Formwork · Formwork

G3Xar · Published 2026-02-19 · Updated 2026-03-23 · CVE-2026-27198

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Formwork versions 2.0.0 through 2.3.3

Description Formwork is a flat file-based Content Management System (CMS). The application does not properly enforce role-based authorization during account creation. Specifically, it does not verify if the current user has the necessary privileges to assign highly privileged roles, such as admin. This allows an authenticated user with the editor role to create a new account with administrative privileges, resulting in full administrative access and potential compromise of the CMS.

Recommendations Update to version 2.3.4 or later.

Exploit

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-27198

GHSA-34P4-7W83-35G2

Affected Products

Formwork

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27198.json · Exploit
• https://github.com/getformwork/formwork/security/advisories/GHSA-34p4-7w83-35g2 · Vendor Advisory
• https://github.com/getformwork/formwork/commit/19390a0b408e084bdef86f3581e050f3ee51e7cd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27198 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27198 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-34p4-7w83-35g2 · Vendor Advisory
• https://github.com/getformwork/formwork · Note
• https://github.com/getformwork/formwork/releases/tag/2.3.4 · Note
• https://twitter.com/pulsepatchio/status/2025579930566680767 · Twitter Post
• https://t.me/CVEtracker/45349 · Telegram Post
• https://twitter.com/TheRabbitPy/status/2036209036220043688 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2025142215375208769 · Twitter Post
• https://t.me/cveNotify/152696 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1raarn5/resumen_diario_de_vulnerabilidades_20022026 · Reddit Post
• https://twitter.com/CVEnew/status/2025154191711260809 · Twitter Post