CVE-2026-28803CWE-284

Open Forms possible to view submission details of other people than intended

Medium · published March 11, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
27.8
In the wild
Unconfirmed
What it is

Open Forms allows users create and publish smart forms. Prior to 3.3.13 and 3.4.5, to be able to cosign, the cosigner receives an e-mail with instructions or a deep-link to start the cosign flow. The submission reference is communicated so that the user can retrieve the submission to be cosigned. Attackers can guess a code or modify the received code to look up arbitrary submissions, after logging in (with DigiD/eHerkenning/... depending on form configuration). This vulnerability is fixed in 3.3.13 and 3.4.5.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00354 · 27.8th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-03-11T15:52Z
EPSS history
Timeline
  • 11 MAR 15:52Z
    Open Forms possible to view submission details of other people than intended
    cvelistv5