{"id":"CVE-2026-107856","summary":"CiviForm: Trusted-Intermediary IDOR discloses any citizen's name and email","details":"CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditClientForm performs a raw lookupAccount(accountId) without confirming that the citizen account belongs to the requester's trustedIntermediaryGroup. An authenticated Trusted Intermediary can enumerate accountId values and read the applicant display name, including the citizen's name and email address, for accounts outside the intermediary's group. This issue is fixed in version 3.33.0.","aliases":["GHSA-qv7c-9hjr-9rv7"],"modified":"2026-10-11T07:04:27.260285681Z","published":"2026-10-09T20:32:10.885Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-639"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107856.json"},"references":[{"type":"WEB","url":"https://github.com/civiform/civiform/releases/tag/v3.33.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107856.json"},{"type":"ADVISORY","url":"https://github.com/civiform/civiform/security/advisories/GHSA-qv7c-9hjr-9rv7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107856"},{"type":"FIX","url":"https://github.com/civiform/civiform/commit/ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e"},{"type":"FIX","url":"https://github.com/civiform/civiform/pull/13635"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/civiform/civiform","events":[{"introduced":"0"},{"fixed":"ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e"},{"fixed":"13406c2018649d57ed50c63bb4074d5dd8ebcb3d"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"3.33.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v3.32.0","v3.31.0","v3.30.0","v3.29.0","v3.28.0","v3.27.0","v3.26.0","v3.25.0","v3.24.0","v3.23.0","v3.22.0","v3.21.0","v3.20.0","v3.19.0","v3.18.0","v3.17.0","v3.16.0","v3.15.0","v3.14.0","v3.13.0","v3.12.0","v3.11.0","v3.10.0","v3.9.0","v3.8.0","v3.7.0","v3.6.0","v3.5.0","v3.4.0","v3.3.0","v3.2.0","v3.1.0","v3.0.0","v2.41.0","v2.40.0","v2.39.0","v2.38.0","v2.37.0","v2.36.0","v2.35.0","v2.34.0","v2.33.0","v2.32.0","v2.31.0","v2.30.0","v2.29.0","v2.28.0","v2.27.0","v2.26.0","v2.25.0","v2.24.0","v2.23.0","v2.22.0","v2.21.0","v2.20.0","v2.19.0","v2.18.0","v2.17.0","v2.16.0","v2.15.0","v2.14.0","v2.13.0","v2.12.0","v2.11.0","v2.10.0","v2.9.0","v2.8.0","v2.7.0","v2.6.0","v2.5.0","v2.4.3","v2.4.2","v2.4.1","v2.4.0","v2.3.0","v2.2.0","v2.1.0","v2.0.2","v2.0.1","v2.0.0","v1.63.0","v1.62.0","v1.61.0","v1.60.0","v1.59.0","v1.58.0","v1.57.0","v1.56.1","v1.56.0","v1.55.0","v1.54.0","v1.53.0","v1.52.0","v1.51.0","v1.50.0","v1.49.0","v1.48.0","v1.47.0","v1.46.0","v1.45.0","v1.44.0","v1.43.0","v1.42.0","v1.41.0","v1.40.0","v1.39.0","v1.38.2","v1.38.1","v1.38.0","v1.37.0","v1.36.0","v1.35.0","v1.34.2","v1.34.1","v1.34.0","v1.33.0","v1.32.0","v1.31.0","v1.30.1","v1.30.0","v1.29.0","v1.28.0","v1.27.0","v1.26.0","v1.25.0","v1.24.0","v1.23.0","v1.22.0","v1.21.0","v1.20.1","v1.20.0","v1.19.0","v1.18.1","v1.18.0","v1.17.0","v1.16.0","v1.15.0","v1.14.0","v1.13.0","v1.12.0","v1.11.0","v1.10.1","v1.10.0","v1.9.0","v1.8.5","v1.8.4","v1.8.3","v1.8.2","v1.8.1","v1.8.0","v1.7.0","v1.6.0","v1.5.2","v1.5.1","v1.5.0","v1.4.0","v1.3.1","v1.3.0","v1.2.0","v1.1.0","v1.0.0","v0.0.0"],"database_specific":{"vanir_signatures_modified":"2026-10-11T07:04:27Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107856.json","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/civiform/civiform/commit/ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e","target":{"file":"server/test/controllers/applicant/ApplicantProgramIneligibleControllerTest.java"},"deprecated":false,"digest":{"line_hashes":["278419434527871627275166316545176539827","309196399353585858118708483162374959756","14597406546602731208526545648256161529","124842802763121569399467721055608390478","273394655855287440072480454036599479526","18993334832733875641768486930499299392"],"threshold":0.9},"id":"CVE-2026-107856-0fd219b8"},{"id":"CVE-2026-107856-22ce2747","signature_type":"Line","signature_version":"v1","source":"https://github.com/civiform/civiform/commit/ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e","target":{"file":"server/app/controllers/ti/TrustedIntermediaryController.java"},"deprecated":false,"digest":{"line_hashes":["183043007364068537604165582815346362630","149489937068194214444336857988270589019","18037927855568200062281737254909710284","122528142267660234094650003216421482554","143033843996890795460510296798596544278"],"threshold":0.9}},{"source":"https://github.com/civiform/civiform/commit/ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e","target":{"file":"server/app/controllers/applicant/ApplicantAddressCorrectionController.java","function":"addressCorrectionInternal"},"deprecated":false,"digest":{"length":1684,"function_hash":"215029790930034081717952953381591420558"},"id":"CVE-2026-107856-552a9c7b","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["225995424082051190172825463350123228317","169039174953689307538384394460821382204","174153030576797149368801652346507660784","28791393843035942638473012386882498492","128141488277868034988494328263774424146","39288741229525109108745095302796150428","132971485385109430021141688659855174520","4287143645315110527709472221935048694","149750409224273100787504155428073848332"],"threshold":0.9},"id":"CVE-2026-107856-6689b693","signature_type":"Line","signature_version":"v1","source":"https://github.com/civiform/civiform/commit/ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e","target":{"file":"server/test/controllers/ti/TrustedIntermediaryControllerTest.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/civiform/civiform/commit/ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e","target":{"file":"server/app/controllers/applicant/ApplicantProgramIneligibleController.java","function":"ineligibleInternal"},"deprecated":false,"digest":{"function_hash":"3922771288161920590772971240656769287","length":1365},"id":"CVE-2026-107856-70dc18af","signature_type":"Function"},{"target":{"file":"server/app/controllers/ti/TrustedIntermediaryController.java","function":"showEditClientForm"},"deprecated":false,"digest":{"function_hash":"93635471133911364294012403315979652092","length":585},"id":"CVE-2026-107856-83419a8f","signature_type":"Function","signature_version":"v1","source":"https://github.com/civiform/civiform/commit/ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e"},{"signature_version":"v1","source":"https://github.com/civiform/civiform/commit/ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e","target":{"file":"server/test/controllers/applicant/ApplicantAddressCorrectionControllerTest.java"},"deprecated":false,"digest":{"line_hashes":["278419434527871627275166316545176539827","309196399353585858118708483162374959756","14597406546602731208526545648256161529","124842802763121569399467721055608390478","116937047136848434395183561345140092566","158463306998558982395622876826049843050","312609442810592549209136155494537688599"],"threshold":0.9},"id":"CVE-2026-107856-d03b1b9a","signature_type":"Line"},{"id":"CVE-2026-107856-e1f69519","signature_type":"Line","signature_version":"v1","source":"https://github.com/civiform/civiform/commit/ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e","target":{"file":"server/app/controllers/applicant/ApplicantProgramIneligibleController.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["252636694586944106402741163582645099255","235171499572968388219739508221164598570","48715764159625080998411919948037621907","311272908955198916909358316817705400447","80975485655310483625964716037961879767","81129682372869458871910991689467469984","142245701071291129472436026622053437742","293406483557514295411542020348077852141","21481018608703071330868789972938032216","27590507564726056014303572562957067385","317570188932628376543208586214635575779","155920609732339139468778312861013523729","121435261999092933354992329504822945534","200289245138508627346980367670183007678","48826498663069746167695238334835942318","139168654062775551659625724730164648296","171804889336381515270290206859183036567","141737365636819828322474742332451490230","85611664370226922007154972204504084823","128876203299162221113819884437748339867","226767255354380465900539304088383917684","126299912226076265972576021198292394535","136902932132727401580972233906728489747","326419845332914307961442805653234242556","320112342453201578610631489961026335488","140650875432094340364696933031952838019","156002827786621566934717160652198218860","143362047379770647678325732968342956708","200221857813917943367208195727536164183","287150301588339281437282078885077981647","198660467147916131675970714045772525058","196599034235866222825179525274837821282","151798765242815915427735557781872941814","118336723059408865734596985292711887220","230771752301701488935448038918044338653","20981036420138945718521229109771454649","186180819821048416926737233210992065383","193200935798356125197962246644759115270","183950163497418922396404000262678515420","233534616658804105611397542894664210247","226388681739770005904090072124651520547","177069569207349215449432580243254398436","287822148747142136161393753658875360173","139292477836846258141292880250141701538","310496494524604392568018988661990618717","240323252332306929043228988814424682020","61990504960984484292887357798671894083","193302536596008277511160824157099310230","28126894736544487496234381784934985176","171258541598301500044586553349756313843","84835788876898201976492238026387242446","192492264386206131370700744915487592695","176746504018511029722187426433805283126","77974967673112760119469240445332378680"]}},{"target":{"file":"server/app/controllers/applicant/ApplicantAddressCorrectionController.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["252636694586944106402741163582645099255","235171499572968388219739508221164598570","48715764159625080998411919948037621907","311272908955198916909358316817705400447","80975485655310483625964716037961879767","81129682372869458871910991689467469984","142245701071291129472436026622053437742","293406483557514295411542020348077852141","116708026931879680916989139119755975910","251300998438554776943523539673664521911","308296763074033592299170874543871583331","167064128082197547683166950029423340355","135091590663034196492786384873493348417","298254590952440527024409097847244503456","254952854856163081173366866987204259378","109992864036836969465875162482928373879","275061946483515575655032369538360074017","107285619121781100782405751275331897816","4365875063587018453389569369252426498","121435261999092933354992329504822945534","200289245138508627346980367670183007678","156933091316178942706737004245038670628","335759705353506493958767598053169389079","249612293177248195993043069465998030346","333334069612978762123244340546383721456","223500397445412645431298763409819695017","188529690392064729238587676861669515565","167554307186292216102780460602322477474","70779857166180216709492555430132960897","42559812608964805301612305268332737125","193651361166140357338022012692058378134","160340353394465584590595615017554075547","148872046467881241869073695473208106019","62167412687600331791668929133357351350","321066591141489752387059173611328722052","211853750601035254455683250548989878831","122947598327098604788736120407243361108","323255202481755592154806252450270291711","315303187051501373547515449966483966518","72196787288033804659503285209852047546","126350546496493129450072746537666994394","185549387918489090038307348477047192298","64507270842576799424574697343454967809","264251671234004692841908084932913942139","76933997749329014596289957988172763729","310124683784709063759717641692569647671","29381223645620636255694183649621018422","270198699715066273152992162206599022051","313147389361441160816982563767162226808","60780601836608565476111215218989182989","27392173820822500994772872140102101797","222555830343225930461160279855788503694","119551171096668394471018939108727687025","71859036581163742647838026936638682659","34604457593896516527166589736468709996","98370782539822407569589158056797329467","15930165196109329318030244028178493736","275473197800723280539766163226522569032","242643225902639978778267972187905241700","287822148747142136161393753658875360173","317236828567031715692830749054811063757","42669455215845592408522202014961764164","235521277043597891941408664843907312801","22731731394158236352761627178374978144","61340988081789680619741769474725821803","193302536596008277511160824157099310230","28126894736544487496234381784934985176","171258541598301500044586553349756313843","84835788876898201976492238026387242446","192492264386206131370700744915487592695","176746504018511029722187426433805283126","77974967673112760119469240445332378680"]},"id":"CVE-2026-107856-e2e56909","signature_type":"Line","signature_version":"v1","source":"https://github.com/civiform/civiform/commit/ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N"}]}