CVEvulnerability
CVE-2026-75106
9.3 CRITICAL
Official page ↗
- Status
- Deferred
- Published
- 2026-08-17
- Last modified
- 2026-10-01
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 9.3 CRITICAL — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-340
Description
OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or overwrite submissions by supplying predicted hashes to the answer endpoint.
Related
Weakness · CWE (1)
- CWE-340 Generation of Predictable Numbers or Identifiers weakness
References
- https://github.com/OpnForm/OpnForm github.com
- https://github.com/OpnForm/OpnForm/commit/6c67ff0a9bc0ac27ae26b32b8e108a176f8161b1 github.com
- https://github.com/OpnForm/OpnForm/issues/1259 github.com
- https://github.com/OpnForm/OpnForm/releases/tag/v2.0.2 github.com
- https://www.vulncheck.com/advisories/opnform-editable-submission-secret-derivation-via-empty-hashids-salt www.vulncheck.com
- https://github.com/OpnForm/OpnForm/issues/1259 github.com