civiform vulnerabilities

Products

• civiform 1

Latest civiform CVEs

Newest publication first

1. CVE-2026-107856 CiviForm: Trusted-Intermediary IDOR discloses any citizen's name and email

   Published 2026-10-09

   Medium·CVSS 4.5 EPSS 0.23%

   CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditClientForm performs a r...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.