« Volver al listado

CVE-2026-28803

Estado: AnalizadaMedia (6.5)—

Open Forms allows users create and publish smart forms. Prior to 3.3.13 and 3.4.5, to be able to cosign, the cosigner receives an e-mail with instructions or a deep-link to start the cosign flow. The submission reference is communicated so that the user can retrieve the submission to be cosigned. Attackers can guess a code or modify the received code to look up arbitrary submissions, after logging in (with DigiD/eHerkenning/... depending on form configuration). This vulnerability is fixed in 3.3.13 and 3.4.5.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Maykinmedia — Open Forms

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-28803",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-28803",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-11T17:30:34.864496Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "open-formulieren",
          "product": "open-forms",
          "versions": [
            {
              "status": "affected",
              "version": ">= 3.4.0-alpha.0, < 3.4.5"
            },
            {
              "status": "affected",
              "version": "< 3.3.13"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-11T16:16:40.630",
  "references": [
    {
      "url": "https://github.com/open-formulieren/open-forms/security/advisories/GHSA-2g49-rfm6-5qj5",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Open Forms allows users create and publish smart forms. Prior to 3.3.13 and 3.4.5, to be able to cosign, the cosigner receives an e-mail with instructions or a deep-link to start the cosign flow. The submission reference is communicated so that the user can retrieve the submission to be cosigned. Attackers can guess a code or modify the received code to look up arbitrary submissions, after logging in (with DigiD/eHerkenning/... depending on form configuration). This vulnerability is fixed in 3.3.13 and 3.4.5."
    },
    {
      "lang": "es",
      "value": "Open Forms permite a los usuarios crear y publicar formularios inteligentes. Antes de 3.3.13 y 3.4.5, para poder cosignar, el cosignatario recibe un correo electrónico con instrucciones o un enlace profundo para iniciar el flujo de cosignatura. La referencia de la presentación se comunica para que el usuario pueda recuperar la presentación a ser cosignada. Los atacantes pueden adivinar un código o modificar el código recibido para buscar presentaciones arbitrarias, después de iniciar sesión (con DigiD/eHerkenning/... dependiendo de la configuración del formulario). Esta vulnerabilidad está corregida en 3.3.13 y 3.4.5."
    }
  ],
  "lastModified": "2026-06-17T10:29:04.377",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:maykinmedia:open_forms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "19C86DE6-DC79-4B71-89AD-3A43741BE51D",
              "versionEndExcluding": "3.3.13"
            },
            {
              "criteria": "cpe:2.3:a:maykinmedia:open_forms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DFE1882C-1659-4E5A-B21A-D08B09DA32B8",
              "versionEndExcluding": "3.4.5",
              "versionStartIncluding": "3.4.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}