Authenticated IDOR Vulnerability in FlowForms

FlowForms versions 1.1.1 and earlier contain an Insecure Direct Object Reference (IDOR) vulnerability (CVE-2026-12400) within the REST API endpoint responsible for form management. The vulnerability resides in the path /flowforms/v1/forms/{id}, where the system fails to adequately validate the authorization level of the requesting user against the requested form ID. An attacker with a low-privileged account, such as a contributor, can manipulate the ID parameter in the request to modify forms they are not authorized to access or manage. A proof-of-concept exploit is publicly available, increasing the likelihood of exploitation by actors seeking to alter form content or disrupt organizational workflows.

Impact

Successful exploitation allows an authenticated user to perform unauthorized modifications to forms within the FlowForms application. This can lead to data integrity issues, unauthorized data collection via modified input fields, or workflow disruption. The impact is limited to the application scope, but poses a significant risk to organizations relying on FlowForms for internal or public-facing data collection.

Recommendation

• Upgrade FlowForms to a version beyond 1.1.1 immediately to remediate CVE-2026-12400.
• Review user permission assignments to ensure that accounts with contributor-level access are strictly limited to necessary form modification scopes.
• Audit web server access logs for anomalous patterns of repeated POST or PUT requests to the /flowforms/v1/forms/ endpoint originating from low-privileged user accounts.