CVE-2026-27198

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-27198
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27198.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-27198
Aliases
Published
2026-02-21T05:11:42.535Z
Modified
2026-02-25T02:37:09.320852Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Formwork Improperly Manages Privileges During User Creation
Details

Formwork is a flat file-based Content Management System (CMS). In versions 2.0.0 through 2.3.3, the application fails to properly enforce role-based authorization during account creation. Although the system validates that the specified role exists, it does not verify whether the current user has sufficient privileges to assign highly privileged roles such as admin. As a result, an authenticated user with the editor role can create a new account with administrative privileges, leading to full administrative access and complete compromise of the CMS. This issue has been fixed in version 2.3.4.

Database specific 
{
    "cwe_ids": [
        "CWE-269"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27198.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/getformwork/formwork

Affected ranges

Type
GIT
Repo
https://github.com/getformwork/formwork
Events
Introduced
ab7efac5ef7055e4e93815412a0f791e67c7b8d9
Fixed
bc64eac8279834a4c8c08c04412eb7dfa27f4fe5

Affected versions

2.*
2.0.0
2.0.1
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
2.2.1
2.2.2
2.3.0
2.3.1
2.3.2
2.3.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27198.json"