CVE-2026-28803

6.5 mediumEPSS 0.2%

Medium (6.5) in maykinmedia open forms. EPSS 0.2% chance of exploitation in the next 30 days.

Open Forms allows users create and publish smart forms. Prior to 3.3.13 and 3.4.5, to be able to cosign, the cosigner receives an e-mail with instructions or a deep-link to start the cosign flow. The submission reference is communicated so that the user can retrieve the submission to be cosigned. Attackers can guess a code or modify the received code to look up arbitrary submissions, after logging in (with DigiD/eHerkenning/... depending on form configuration). This vulnerability is fixed in 3.3.13 and 3.4.5.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-31)
CWE: CWE-284
Published: 2026-03-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

maykinmedia:open_forms

References

https://github.com/open-formulieren/open-forms/security/advisories/GHSA-2g49-rfm6-5qj5

Check your stack JSON