Formwork Improperly Managed Privileges in User creation
The advisory, in context
Summary
The application fails to properly enforce role-based authorization during account creation. Although the system validates that the specified role exists, it does not verify whether the current user has sufficient privileges to assign highly privileged roles such as admin. As a result, an authenticated user with the editor role can create a new account with administrative privileges, leading to full administrative access and complete compromise of the CMS.
Impact
Successful exploitation allows an attacker to:
- Gain full administrative control over the CMS.
- Access all site data and user information.
- Modify system configuration and security settings.
- Create, modify, or delete any user account, including legitimate administrators.
Patches
Formwork 2.3.4 properly assigns roles on user creation.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 2.0.0 before 2.3.4
Fixed in 2.3.4
15 explicitly affected versions
2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.3.2, 2.3.3
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.3.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.0.0",
"2.0.1",
"2.1.0",
"2.1.1",
"2.1.2",
"2.1.3",
"2.1.4",
"2.1.5",
"2.2.0",
"2.2.1",
"2.2.2",
"2.3.0",
"2.3.1",
"2.3.2",
"2.3.3"
]
}References
- https://github.com/getformwork/formwork/security/advisories/GHSA-34p4-7w83-35g2
- https://nvd.nist.gov/vuln/detail/CVE-2026-27198
- https://github.com/getformwork/formwork/commit/19390a0b408e084bdef86f3581e050f3ee51e7cd
- https://github.com/getformwork/formwork
- https://github.com/getformwork/formwork/releases/tag/2.3.4