Civiform
Monthly
An authenticated insecure direct object reference in CiviForm before 3.33.0 lets a Trusted Intermediary read the display name and email address of applicants belonging to other trusted intermediary groups by enumerating account IDs through GET /admin/tiDash/editClientForm/:accountId. The route enforces the Trusted Intermediary role but the downstream showEditClientForm handler performs a raw lookupAccount(accountId) without verifying that the citizen account falls inside the caller's trustedIntermediaryGroup, so varying the accountId path parameter returns a different applicant's personal identifiers. Exploitation requires a legitimate, admin-provisioned Trusted Intermediary account, the disclosed data is limited to name and email (not full application contents), and the fix ships in version 3.33.0; no public exploit code or confirmed active exploitation was identified at time of analysis, and the risk is a moderate-severity authorization flaw rather than a broad data breach.
An authenticated insecure direct object reference in CiviForm before 3.33.0 lets a Trusted Intermediary read the display name and email address of applicants belonging to other trusted intermediary groups by enumerating account IDs through GET /admin/tiDash/editClientForm/:accountId. The route enforces the Trusted Intermediary role but the downstream showEditClientForm handler performs a raw lookupAccount(accountId) without verifying that the citizen account falls inside the caller's trustedIntermediaryGroup, so varying the accountId path parameter returns a different applicant's personal identifiers. Exploitation requires a legitimate, admin-provisioned Trusted Intermediary account, the disclosed data is limited to name and email (not full application contents), and the fix ships in version 3.33.0; no public exploit code or confirmed active exploitation was identified at time of analysis, and the risk is a moderate-severity authorization flaw rather than a broad data breach.