Which versions of OpnForm are affected by CVE-2026-75106?

OpnForm contains a critical access control vulnerability that exposes all submitted form data to unauthorized access and modification by unauthenticated attackers.. A patch is available.

How to fix or mitigate CVE-2026-75106?

Within 24 hours, identify all OpnForm instances running versions prior to v2.0.2 and take affected servers offline or restrict network access until patching is complete. Within 7 days, deploy OpnForm v2.0.2 or later to all production instances after validating in a staging environment. Within 30 days, review submission activity logs for the vulnerable period to detect unauthorized access, notify data subjects if breach confirmed per regulatory requirements, and document the incident timeline for audit purposes.

OpnForm CVE-2026-75106

Q: What is the CVSS score of CVE-2026-75106?

CVE-2026-75106 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-60386 CRITICAL

Generation of Predictable Numbers or Identifiers (CWE-340)

2026-08-17 VulnCheck

GHSA-3j74-gjwg-45jm

Information Disclosure Opnform

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Remote, unauthenticated, no interaction, low complexity against default config; predictable IDs allow reading (C:H) and overwriting (I:H) submissions with no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 17, 2026 - 21:10 vuln.today

Analysis Generated

Aug 17, 2026 - 21:10 vuln.today

CVE Published

Aug 17, 2026 - 20:36 cve.org

CRITICAL 9.3

DescriptionCVE.org

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or overwrite submissions by supplying predicted hashes to the answer endpoint.

AnalysisAI

Broken access control in OpnForm's editable-submission feature lets unauthenticated attackers derive any submission's secret because the Hashids library is used with an empty default salt over sequential database row IDs. Since the hash of a sequential integer becomes trivially predictable, an attacker can enumerate submissions to read other respondents' full answer data via the submission-fetch endpoint or overwrite existing submissions through the answer endpoint. Reported by VulnCheck and patched in v2.0.2; there is no public exploit identified at time of analysis, but the flaw is remotely and trivially reproducible against affected default installs.

Technical ContextAI

OpnForm is an open-source (Laravel/PHP) form-building application. The editable-submission workflow issued each submission an identifier via the Vinkla/Hashids Laravel wrapper (Hashids::encode($submission->id)). Hashids is an obfuscation, not a cryptographic, primitive: with no salt configured it uses a fixed default alphabet and ordering, so encoding the auto-incrementing primary key produces a deterministic, reversible token. This maps directly to CWE-340 (Generation of Predictable Numbers or Identifiers) - the 'secret' carries no entropy independent of the row ID. The patched code (commit 6c67ff0a, files PublicFormController.php and SubmissionUrlService.php) removes all Hashids usage and forces submissions to be addressed by an unguessable UUID stored in public_id, with a migration backfilling public_id for existing rows and 404s returned for any legacy Hashid lookups.

RemediationAI

Vendor-released patch: upgrade to OpnForm v2.0.2 (https://github.com/OpnForm/OpnForm/releases/tag/v2.0.2), which replaces Hashids-based submission identifiers with random UUIDs (public_id) and backfills UUIDs for existing submissions via database migration, returning 404 for any legacy Hashid lookup. If immediate upgrade is not possible, the most effective compensating control is to disable or restrict the editable-submission feature so the submission-fetch and answer endpoints cannot be reached by anonymous users - recognizing this removes respondents' ability to view or edit their own submissions; alternatively, place the affected endpoints behind authentication or a WAF rule that blocks direct enumeration of submission identifiers, and treat any previously collected submission data as potentially exposed. As a hardening step even after patching, configure a non-empty Hashids salt (HASHIDS_SALT) so any residual code paths do not emit predictable tokens. Apply the fix per the VulnCheck advisory: https://www.vulncheck.com/advisories/opnform-editable-submission-secret-derivation-via-empty-hashids-salt.