Formwork Improperly Managed Privileges in User creation
Summary
The application fails to properly enforce role-based authorization during account creation. Although the system validates that the specified role exists, it does not verify whether the current user has sufficient privileges to assign highly privileged roles such as admin. As a result, an authenticated user with the editor role can create a new account with administrative privileges, leading to full administrative access and complete compromise of the CMS.
Impact
Successful exploitation allows an attacker to:
- Gain full administrative control over the CMS.
- Access all site data and user information.
- Modify system configuration and security settings.
- Create, modify, or delete any user account, including legitimate administrators.
Patches
Formwork 2.3.4 properly assigns roles on user creation.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | getformwork/formwork | >= 2.0.0, < 2.3.4 | 2.3.4 |
References
- https://github.com/getformwork/formwork/security/advisories/GHSA-34p4-7w83-35g2
- https://nvd.nist.gov/vuln/detail/CVE-2026-27198
- https://github.com/getformwork/formwork/commit/19390a0b408e084bdef86f3581e050f3ee51e7cd
- https://github.com/getformwork/formwork
- https://github.com/getformwork/formwork/releases/tag/2.3.4
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-269- Platform
- Composer
- Package
getformwork/formwork- Disclosed
- 19.02.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-34p4-7w83-35g2 - CC BY 4.0
Vulnerability history: getformwork/formwork
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 7
- First → latest
- 02.2023 02.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 5
Disclosures per year
- 2023: 1
- 2024: 2
- 2025: 3
- 2026: 1
-
Formwork Improperly Managed Privileges in User creation this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.