CVE-2026-28803: maykinmedia open forms

csirt@kutim:~/threat-intel/cve/CVE-2026-28803

CVSS 6.5 · Medium EPSS 0,35%

Kerentanan Improper Access Control pada maykinmedia open forms. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

Open Forms allows users create and publish smart forms. Prior to 3.3.13 and 3.4.5, to be able to cosign, the cosigner receives an e-mail with instructions or a deep-link to start the cosign flow. The submission reference is communicated so that the user can retrieve the submission to be cosigned. Attackers can guess a code or modify the received code to look up arbitrary submissions, after logging in (with DigiD/eHerkenning/... depending on form configuration). This vulnerability is fixed in 3.3.13 and 3.4.5.

Rincian

Terbit di NVD: 11 Maret 2026
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-284: Improper Access Control
EPSS (30 hari): 0,35% peluang dieksploitasi; lebih tinggi dari 27,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
maykinmedia	open forms	Semua versi sebelum 3.3.13
maykinmedia	open forms	Versi 3.4.0 hingga sebelum 3.4.5

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/open-formulieren/open-forms/security/advisories/GHSA-2g49-rfm6-5qj5 mitigasi · advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.