CVE-2026-107856: CiviForm: Trusted-Intermediary IDOR discloses any citizen's name and email
CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditClientForm performs a raw lookupAccount(accountId) without confirming that the citizen account belongs to the requester's trustedIntermediaryGroup. An authenticated Trusted Intermediary can enumerate accountId values and read the applicant display name, including the citizen's name and email address, for accounts outside the intermediary's group. This issue is fixed in version 3.33.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CiviFormto a version that resolves this vulnerability.Fixed in 3.33.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with the Trusted Intermediary role can exploit it. The attacker must be able to send requests to the edit-client-form endpoint and provide account ID values.
What information can be exposed?
The issue can disclose applicant display-name information for citizens outside the intermediary's assigned group, including the citizen's name and email address. Integrity and availability are not affected according to the supplied severity vector.
Are all CiviForm deployments affected by default?
The issue affects versions prior to 3.33.0 where Trusted Intermediaries can access the specified endpoint. Exploitation requires a Trusted Intermediary account; the provided information does not establish whether that role is enabled or assigned by default.
How can we determine whether we are exposed?
Check whether the deployment runs a CiviForm version earlier than 3.33.0 and has Trusted Intermediary users. Affected behavior is indicated if a Trusted Intermediary can request the edit-client-form endpoint with an account ID belonging to a citizen outside that intermediary's group and receive that citizen's details.
What should be done if patching cannot happen immediately?
Restrict or suspend Trusted Intermediary access to the affected edit-client-form functionality until an upgrade to 3.33.0 is possible. Because exploitation requires an authenticated Trusted Intermediary, reviewing and limiting assignments to that role can reduce exposure.