CVE-2026-107856 civiform CVE debrief

Who should care

Defenders of CiviForm installations should assess exposure and apply the patch in version 3.33.0. System administrators and security teams responsible for government benefits programs using CiviForm should verify their version and restrict access to the affected endpoint if patching is not immediately feasible.

Why it matters

CVE-2026-107856 is a medium-severity vulnerability in CiviForm that allows an authenticated Trusted Intermediary to disclose sensitive information about citizens outside their group. Defenders should prioritize patching to version 3.33.0 and restrict access to the affected endpoint. Evidence is limited to official CVE and source item records.

• Enumeration of accountId values by an authenticated Trusted Intermediary
• Disclosure of citizen names and email addresses outside the intermediary's group
• Potential for data misuse by insiders with Trusted Intermediary access
• Verification of patch application and endpoint access controls

Technical summary

Prior to version 3.33.0, CiviForm's GET /admin/tiDash/editClientForm/:accountId endpoint did not properly verify that the requester's trustedIntermediaryGroup had access to the requested citizen account. This allowed an authenticated Trusted Intermediary to read the applicant display name, including the citizen's name and email address, for accounts outside their group. The issue is fixed in version 3.33.0, which properly validates the requester's access to the citizen account. Defenders should prioritize patching to this version.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch in version 3.33.0
• Restrict access to the /admin/tiDash/editClientForm endpoint
• Monitor for suspicious activity on the affected system
• Verify patch application and endpoint access controls
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability. The NVD entry is currently UNCHANGED. Evidence is limited to official CVE and source item records. Defenders should verify patch application and endpoint access controls. The vulnerability allows an authenticated Trusted Intermediary to read applicant display names, including citizen names and email addresses, for accounts outside their group.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.