CVE-2026-27198 json
Formwork Improperly Manages Privileges During User Creation
published 2026-02-19 8 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-7733 , GHSA-34p4-7w83-35g2
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 39%
- public exploits
- 0
- none known
Summary
Formwork is a flat file-based Content Management System (CMS). In versions 2.0.0 through 2.3.3, the application fails to properly enforce role-based authorization during account creation. Although the system validates that the specified role exists, it does not verify whether the current user has sufficient privileges to assign highly privileged roles such as admin. As a result, an authenticated user with the editor role can create a new account with administrative privileges, leading to full administrative access and complete compromise of the CMS. This issue has been fixed in version 2.3.4.
Patch / fix
- packagist getformwork/formwork 2.3.4
- formwork_project formwork 2.3.4
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 8 mo ago
Exploit prediction
0.46% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | getformwork/formwork | >=2.0.0, <2.3.4 |
2.3.4 |
Affected products
- getformwork formwork
Classification
- Weakness
-
- CWE-269 Improper Privilege Management
References
-
github.com
/getformwork/formwork/commit/19390a0b408e084bdef86f3581e050f3ee51e7cd
web, patch
-
github.com
/getformwork/formwork/security/advisories/GHSA-34p4-7w83-35g2
web, patch, vendor-advisory
-
github.com
/getformwork/formwork/releases/tag/2.3.4
web, product, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-27198
advisory
-
github.com
/getformwork/formwork
package
Sources
- CVE List CVE-2026-27198
- GitHub Advisory GHSA-34p4-7w83-35g2
- NVD CVE-2026-27198
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.