FlowForms (<= 1.1.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/flowforms--1.1.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 15 Sep 2026 06:27:09 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthenticated IDOR Vulnerability in FlowFormshttps://feed.craftedsignal.io/briefs/2026-09-flowforms-idor/Tue, 15 Sep 2026 06:27:09 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-flowforms-idor/An authenticated Insecure Direct Object Reference (IDOR) vulnerability in FlowForms version 1.1.1 and earlier allows attackers with contributor-level access to modify arbitrary forms.FlowForms versions 1.1.1 and earlier contain an Insecure Direct Object Reference (IDOR) vulnerability (CVE-2026-12400) within the REST API endpoint responsible for form management. The vulnerability resides in the path /flowforms/v1/forms/{id}, where the system fails to adequately validate the authorization level of the requesting user against the requested form ID. An attacker with a low-privileged account, such as a contributor, can manipulate the ID parameter in the request to modify forms they are not authorized to access or manage. A proof-of-concept exploit is publicly available, increasing the likelihood of exploitation by actors seeking to alter form content or disrupt organizational workflows.

Impact

Successful exploitation allows an authenticated user to perform unauthorized modifications to forms within the FlowForms application. This can lead to data integrity issues, unauthorized data collection via modified input fields, or workflow disruption. The impact is limited to the application scope, but poses a significant risk to organizations relying on FlowForms for internal or public-facing data collection.

Recommendation

  • Upgrade FlowForms to a version beyond 1.1.1 immediately to remediate CVE-2026-12400.
  • Review user permission assignments to ensure that accounts with contributor-level access are strictly limited to necessary form modification scopes.
  • Audit web server access logs for anomalous patterns of repeated POST or PUT requests to the /flowforms/v1/forms/ endpoint originating from low-privileged user accounts.
]]>mediumthreatidorweb-vulnerabilityflowformscve-2026-12400