CVE-2026-107856
- Source
- https://cve.org/CVERecord?id=CVE-2026-107856
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107856.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-107856
- Aliases
-
- GHSA-qv7c-9hjr-9rv7
- Published
- 2026-10-09T20:32:10Z
- Modified
- 2026-10-11T07:04:27Z
- Severity
-
- 4.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- CiviForm: Trusted-Intermediary IDOR discloses any citizen's name and email
- Details
-
CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditClientForm performs a raw lookupAccount(accountId) without confirming that the citizen account belongs to the requester's trustedIntermediaryGroup. An authenticated Trusted Intermediary can enumerate accountId values and read the applicant display name, including the citizen's name and email address, for accounts outside the intermediary's group. This issue is fixed in version 3.33.0.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-639" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107856.json" }- References
-
- https://github.com/civiform/civiform/releases/tag/v3.33.0
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107856.json
- https://github.com/civiform/civiform/security/advisories/GHSA-qv7c-9hjr-9rv7
- https://nvd.nist.gov/vuln/detail/CVE-2026-107856
- https://github.com/civiform/civiform/commit/ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e
- https://github.com/civiform/civiform/pull/13635
Affected packages
Git / github.com/civiform/civiform
Affected versions
v0.*
v0.0.0
v1.*
v1.0.0
v1.1.0
v1.10.0
v1.10.1
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.15.0
v1.16.0
v1.17.0
v1.18.0
v1.18.1
v1.19.0
v1.2.0
v1.20.0
v1.20.1
v1.21.0
v1.22.0
v1.23.0
v1.24.0
v1.25.0
v1.26.0
v1.27.0
v1.28.0
v1.29.0
v1.3.0
v1.3.1
v1.30.0
v1.30.1
v1.31.0
v1.32.0
v1.33.0
v1.34.0
v1.34.1
v1.34.2
v1.35.0
v1.36.0
v1.37.0
v1.38.0
v1.38.1
v1.38.2
v1.39.0
v1.4.0
v1.40.0
v1.41.0
v1.42.0
v1.43.0
v1.44.0
v1.45.0
v1.46.0
v1.47.0
v1.48.0
v1.49.0
v1.5.0
v1.5.1
v1.5.2
v1.50.0
v1.51.0
v1.52.0
v1.53.0
v1.54.0
v1.55.0
v1.56.0
v1.56.1
v1.57.0
v1.58.0
v1.59.0
v1.6.0
v1.60.0
v1.61.0
v1.62.0
v1.63.0
v1.7.0
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.8.5
v1.9.0
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.1.0
v2.10.0
v2.11.0
v2.12.0
v2.13.0
v2.14.0
v2.15.0
v2.16.0
v2.17.0
v2.18.0
v2.19.0
v2.2.0
v2.20.0
v2.21.0
v2.22.0
v2.23.0
v2.24.0
v2.25.0
v2.26.0
v2.27.0
v2.28.0
v2.29.0
v2.3.0
v2.30.0
v2.31.0
v2.32.0
v2.33.0
v2.34.0
v2.35.0
v2.36.0
v2.37.0
v2.38.0
v2.39.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.40.0
v2.41.0
v2.5.0
v2.6.0
v2.7.0
v2.8.0
v2.9.0
v3.*
v3.0.0
v3.1.0
v3.10.0
v3.11.0
v3.12.0
v3.13.0
v3.14.0
v3.15.0
v3.16.0
v3.17.0
v3.18.0
v3.19.0
v3.2.0
v3.20.0
v3.21.0
v3.22.0
v3.23.0
v3.24.0
v3.25.0
v3.26.0
v3.27.0
v3.28.0
v3.29.0
v3.3.0
v3.30.0
v3.31.0
v3.32.0
v3.4.0
v3.5.0
v3.6.0
v3.7.0
v3.8.0
v3.9.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107856.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"278419434527871627275166316545176539827",
"309196399353585858118708483162374959756",
"14597406546602731208526545648256161529",
"124842802763121569399467721055608390478",
"273394655855287440072480454036599479526",
"18993334832733875641768486930499299392"
],
"threshold": 0.9
},
"id": "CVE-2026-107856-0fd219b8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/civiform/civiform/commit/ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e",
"target": {
"file": "server/test/controllers/applicant/ApplicantProgramIneligibleControllerTest.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"183043007364068537604165582815346362630",
"149489937068194214444336857988270589019",
"18037927855568200062281737254909710284",
"122528142267660234094650003216421482554",
"143033843996890795460510296798596544278"
],
"threshold": 0.9
},
"id": "CVE-2026-107856-22ce2747",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/civiform/civiform/commit/ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e",
"target": {
"file": "server/app/controllers/ti/TrustedIntermediaryController.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "215029790930034081717952953381591420558",
"length": 1684
},
"id": "CVE-2026-107856-552a9c7b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/civiform/civiform/commit/ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e",
"target": {
"file": "server/app/controllers/applicant/ApplicantAddressCorrectionController.java",
"function": "addressCorrectionInternal"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"225995424082051190172825463350123228317",
"169039174953689307538384394460821382204",
"174153030576797149368801652346507660784",
"28791393843035942638473012386882498492",
"128141488277868034988494328263774424146",
"39288741229525109108745095302796150428",
"132971485385109430021141688659855174520",
"4287143645315110527709472221935048694",
"149750409224273100787504155428073848332"
],
"threshold": 0.9
},
"id": "CVE-2026-107856-6689b693",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/civiform/civiform/commit/ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e",
"target": {
"file": "server/test/controllers/ti/TrustedIntermediaryControllerTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "3922771288161920590772971240656769287",
"length": 1365
},
"id": "CVE-2026-107856-70dc18af",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/civiform/civiform/commit/ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e",
"target": {
"file": "server/app/controllers/applicant/ApplicantProgramIneligibleController.java",
"function": "ineligibleInternal"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "93635471133911364294012403315979652092",
"length": 585
},
"id": "CVE-2026-107856-83419a8f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/civiform/civiform/commit/ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e",
"target": {
"file": "server/app/controllers/ti/TrustedIntermediaryController.java",
"function": "showEditClientForm"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"278419434527871627275166316545176539827",
"309196399353585858118708483162374959756",
"14597406546602731208526545648256161529",
"124842802763121569399467721055608390478",
"116937047136848434395183561345140092566",
"158463306998558982395622876826049843050",
"312609442810592549209136155494537688599"
],
"threshold": 0.9
},
"id": "CVE-2026-107856-d03b1b9a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/civiform/civiform/commit/ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e",
"target": {
"file": "server/test/controllers/applicant/ApplicantAddressCorrectionControllerTest.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"252636694586944106402741163582645099255",
"235171499572968388219739508221164598570",
"48715764159625080998411919948037621907",
"311272908955198916909358316817705400447",
"80975485655310483625964716037961879767",
"81129682372869458871910991689467469984",
"142245701071291129472436026622053437742",
"293406483557514295411542020348077852141",
"21481018608703071330868789972938032216",
"27590507564726056014303572562957067385",
"317570188932628376543208586214635575779",
"155920609732339139468778312861013523729",
"121435261999092933354992329504822945534",
"200289245138508627346980367670183007678",
"48826498663069746167695238334835942318",
"139168654062775551659625724730164648296",
"171804889336381515270290206859183036567",
"141737365636819828322474742332451490230",
"85611664370226922007154972204504084823",
"128876203299162221113819884437748339867",
"226767255354380465900539304088383917684",
"126299912226076265972576021198292394535",
"136902932132727401580972233906728489747",
"326419845332914307961442805653234242556",
"320112342453201578610631489961026335488",
"140650875432094340364696933031952838019",
"156002827786621566934717160652198218860",
"143362047379770647678325732968342956708",
"200221857813917943367208195727536164183",
"287150301588339281437282078885077981647",
"198660467147916131675970714045772525058",
"196599034235866222825179525274837821282",
"151798765242815915427735557781872941814",
"118336723059408865734596985292711887220",
"230771752301701488935448038918044338653",
"20981036420138945718521229109771454649",
"186180819821048416926737233210992065383",
"193200935798356125197962246644759115270",
"183950163497418922396404000262678515420",
"233534616658804105611397542894664210247",
"226388681739770005904090072124651520547",
"177069569207349215449432580243254398436",
"287822148747142136161393753658875360173",
"139292477836846258141292880250141701538",
"310496494524604392568018988661990618717",
"240323252332306929043228988814424682020",
"61990504960984484292887357798671894083",
"193302536596008277511160824157099310230",
"28126894736544487496234381784934985176",
"171258541598301500044586553349756313843",
"84835788876898201976492238026387242446",
"192492264386206131370700744915487592695",
"176746504018511029722187426433805283126",
"77974967673112760119469240445332378680"
],
"threshold": 0.9
},
"id": "CVE-2026-107856-e1f69519",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/civiform/civiform/commit/ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e",
"target": {
"file": "server/app/controllers/applicant/ApplicantProgramIneligibleController.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"252636694586944106402741163582645099255",
"235171499572968388219739508221164598570",
"48715764159625080998411919948037621907",
"311272908955198916909358316817705400447",
"80975485655310483625964716037961879767",
"81129682372869458871910991689467469984",
"142245701071291129472436026622053437742",
"293406483557514295411542020348077852141",
"116708026931879680916989139119755975910",
"251300998438554776943523539673664521911",
"308296763074033592299170874543871583331",
"167064128082197547683166950029423340355",
"135091590663034196492786384873493348417",
"298254590952440527024409097847244503456",
"254952854856163081173366866987204259378",
"109992864036836969465875162482928373879",
"275061946483515575655032369538360074017",
"107285619121781100782405751275331897816",
"4365875063587018453389569369252426498",
"121435261999092933354992329504822945534",
"200289245138508627346980367670183007678",
"156933091316178942706737004245038670628",
"335759705353506493958767598053169389079",
"249612293177248195993043069465998030346",
"333334069612978762123244340546383721456",
"223500397445412645431298763409819695017",
"188529690392064729238587676861669515565",
"167554307186292216102780460602322477474",
"70779857166180216709492555430132960897",
"42559812608964805301612305268332737125",
"193651361166140357338022012692058378134",
"160340353394465584590595615017554075547",
"148872046467881241869073695473208106019",
"62167412687600331791668929133357351350",
"321066591141489752387059173611328722052",
"211853750601035254455683250548989878831",
"122947598327098604788736120407243361108",
"323255202481755592154806252450270291711",
"315303187051501373547515449966483966518",
"72196787288033804659503285209852047546",
"126350546496493129450072746537666994394",
"185549387918489090038307348477047192298",
"64507270842576799424574697343454967809",
"264251671234004692841908084932913942139",
"76933997749329014596289957988172763729",
"310124683784709063759717641692569647671",
"29381223645620636255694183649621018422",
"270198699715066273152992162206599022051",
"313147389361441160816982563767162226808",
"60780601836608565476111215218989182989",
"27392173820822500994772872140102101797",
"222555830343225930461160279855788503694",
"119551171096668394471018939108727687025",
"71859036581163742647838026936638682659",
"34604457593896516527166589736468709996",
"98370782539822407569589158056797329467",
"15930165196109329318030244028178493736",
"275473197800723280539766163226522569032",
"242643225902639978778267972187905241700",
"287822148747142136161393753658875360173",
"317236828567031715692830749054811063757",
"42669455215845592408522202014961764164",
"235521277043597891941408664843907312801",
"22731731394158236352761627178374978144",
"61340988081789680619741769474725821803",
"193302536596008277511160824157099310230",
"28126894736544487496234381784934985176",
"171258541598301500044586553349756313843",
"84835788876898201976492238026387242446",
"192492264386206131370700744915487592695",
"176746504018511029722187426433805283126",
"77974967673112760119469240445332378680"
],
"threshold": 0.9
},
"id": "CVE-2026-107856-e2e56909",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/civiform/civiform/commit/ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e",
"target": {
"file": "server/app/controllers/applicant/ApplicantAddressCorrectionController.java"
}
}
]
vanir_signatures_modified
"2026-10-11T07:04:27Z"