CVE-2026-75106 OpnForm CVE debrief

Who should care

Defenders responsible for OpnForm applications should assess exposure and implement compensating controls to restrict access to sensitive submission data. Defenders should prioritize verifying exposure and implementing compensating controls due to the potential for unauthenticated attackers to access sensitive submission data. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

CVE-2026-75106 allows unauthenticated attackers to potentially access sensitive submission data in OpnForm applications. Defenders should verify exposure and implement compensating controls.

• Unauthenticated attackers can compute hashes for any submission
• Potential access to sensitive submission data through the submission-fetch endpoint
• Potential overwriting of submissions by supplying predicted hashes to the answer endpoint
• Verification of exposure and implementation of compensating controls is necessary

Technical summary

The OpnForm application derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission and potentially access sensitive submission data through the submission-fetch endpoint or overwrite submissions by supplying predicted hashes to the answer endpoint. This vulnerability allows unauthenticated attackers to potentially access sensitive submission data in OpnForm applications. Defenders should verify exposure and implement compensating controls.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls due to the potential for unauthenticated attackers to access sensitive submission data.

Recommended defensive actions

• Verify exposure by checking if the OpnForm application is using the vulnerable code
• Implement compensating controls to restrict access to sensitive submission data
• Monitor for potential exploitation attempts
• Apply the patch or updated version when available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected versions and remediation steps require verification from the supplied official sources. The vulnerability allows unauthenticated attackers to potentially access sensitive submission data in OpnForm applications. Defenders should verify exposure and implement compensating controls. The CVE Program record and NVD detail page provide source-provided CVE metadata and vulnerability assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.