Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Open Forms allows users create and publish smart forms. Prior to 3.3.13 and 3.4.5, to be able to cosign, the cosigner receives an e-mail with instructions or a deep-link to start the cosign flow. The submission reference is communicated so that the user can retrieve the submission to be cosigned. Attackers can guess a code or modify the received code to look up arbitrary submissions, after logging in (with DigiD/eHerkenning/... depending on form configuration). This vulnerability is fixed in 3.3.13 and 3.4.5.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-11 | 1 | Disclosure1 |
| 2026-03-15 | 1 | General1 |
CVE-2026-28803 Open Forms Submission Reference Vulnerability Enables Unauthorized Access to Submissions https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28803
Post summary
The text announces CVE-2026-28803, describing an open forms submission reference vulnerability that allows unauthorized access, and directs readers to a webpage for additional details.
CVE-2026-28803 Open Forms allows users create and publish smart forms. Prior to 3.3.13 and 3.4.5, to be able to cosign, the cosigner receives an e-mail with instructions or a deep-l… https://www.cve.org/CVERecord?id=CVE-2026-28803
Post summary
The note references CVE‑2026‑28803 and notes affected Open Forms versions, but provides no PoC, exploitation, patch, or detailed technical data.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | maykinmedia | open_forms | - | - | - |