CVE-2026-107856

CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditClientForm performs a raw...

EUVD-2026-95984

CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditClientForm performs a raw...

CVE-2026-107856

CiviForm versions prior to 3.33.0 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The application fails to properly validate ownership when processing requests to GET /admin/tiDash/editClientForm/:accountId. While the system confirms the requester is a Trusted Intermediary , th...