CVE-2026-28803 Open Forms possible to view submission details of other people than intended

What is CVE-2026-28803?

CVE-2026-28803 is a medium-severity missing authorization vulnerability in open-formulieren open-forms, published on 11 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Open Forms allows users create and publish smart forms. Prior to 3.3.13 and 3.4.5, to be able to cosign, the cosigner receives an e-mail with instructions or a deep-link to start the cosign flow. The submission reference is communicated so that the user can retrieve the submission to be cosigned. Attackers can guess a code or modify the received code to look up arbitrary submissions, after logging in (with DigiD/eHerkenning/... depending on form configuration). This vulnerability is fixed in 3.3.13 and 3.4.5.

Weakness: CWE-284

Which versions are affected by CVE-2026-28803?

It affects 1 product.

Products include Maykinmedia Open Forms.

How do I fix CVE-2026-28803?

No fix has been published for CVE-2026-28803 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-28803 being exploited?

There is no known exploitation of CVE-2026-28803 in the wild and no public exploit code.

Other vulnerabilities in open-formulieren open-forms

• CVE-2024-24771 Open Forms potential multi-factor authentication bypass High 7.7
• CVE-2022-31041 Insufficient content-type validation for uploaded files in open-forms High 7.6
• CVE-2022-31040 Open Redirect in open-forms High 7.1
• CVE-2025-64515 Open Forms prefill data in read-only components can be tampered Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2g49-rfm6-5qj5.