PT-2026-24717 · Git+2 · Open Forms

Bram Bolscher · Published 2026-03-11 · Updated 2026-03-15 · CVE-2026-28803

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open Forms versions prior to 3.3.13 Open Forms versions prior to 3.4.5

Description Open Forms allows users to create and publish smart forms. Prior to versions 3.3.13 and 3.4.5, a cosigner receives an email with instructions or a deep-link to start the cosigning process. The submission reference is communicated, allowing the user to retrieve the submission for cosigning. An attacker can guess or modify the received code to access arbitrary submissions after logging in with DigiD/eHerkenning, or similar authentication methods, depending on the form configuration. The issue involves the potential to access submissions not intended for the cosigner.

Recommendations Update Open Forms to version 3.3.13 or later. Update Open Forms to version 3.4.5 or later.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-28803

GHSA-2G49-RFM6-5QJ5

Affected Products

Open Forms

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28803.json · Exploit
• https://github.com/open-formulieren/open-forms/security/advisories/GHSA-2g49-rfm6-5qj5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28803 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28803 · Vendor Advisory
• https://twitter.com/CVEnew/status/2032998324043685973 · Twitter Post