CVE-2026-107856 CiviForm: Trusted-Intermediary IDOR discloses any citizen's name and email

CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditClientForm performs a raw...