Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Formwork is a flat file-based Content Management System (CMS). In versions 2.0.0 through 2.3.3, the application fails to properly enforce role-based authorization during account creation. Although the system validates that the specified role exists, it does not verify whether the current user has sufficient privileges to assign highly privileged roles such as admin. As a result, an authenticated user with the editor role can create a new account with administrative privileges, leading to full administrative access and complete compromise of the CMS. This issue has been fixed in version 2.3.4.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 CVE-2026-27198 (CVSS 8.8): Formwork CMS v2.0.0-2.3.3 editor role assigns admin via account creation. Full CMS compromise! https://feedly.com/cve/severity/8-9?page=7
Post summary
The post announces CVE-2026-27198 for Formwork CMS, highlighting its high severity and a privilege escalation path via account creation; no exploit, PoC, patch or active exploitation details are provided.
A privilege management flaw in `getformwork/formwork` (CVE-2026-27198) could lead to unauthorized privilege escalation during user creation. Admins should review #Formwork deployments. #infosec #vulnerability https://www.pulsepatch.io/posts/cve-2026-27198-formwork-privilege-management
Post summary
A privilege management flaw in getformwork/formwork (CVE-2026-27198) could allow privilege escalation during user creation; admins are advised to review deployments.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | formwork_project | formwork | - | - | - |