CVE-2026-75106

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or overwrite submissions by supplying predicted hashes to the answer endpoint.

CVSS 4.0

9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-25)

CWE

CWE-340

Published

2026-08-17

Modified

2026-10-01

Record from

the NVD, synced 2026-10-19

References

• https://github.com/OpnForm/OpnForm
• https://github.com/OpnForm/OpnForm/commit/6c67ff0a9bc0ac27ae26b32b8e108a176f8161b1
• https://github.com/OpnForm/OpnForm/issues/1259
• https://github.com/OpnForm/OpnForm/releases/tag/v2.0.2
• https://www.vulncheck.com/advisories/opnform-editable-submission-secret-derivation-via-empty-hashids-salt

Check your stackJSON