CVE-2026-27198

The record

Formwork is a flat file-based Content Management System (CMS). In versions 2.0.0 through 2.3.3, the application fails to properly enforce role-based authorization during account creation. Although the system validates that the specified role exists, it does not verify whether the current user has sufficient privileges to assign highly privileged roles such as admin. As a result, an authenticated user with the editor role can create a new account with administrative privileges, leading to full administrative access and complete compromise of the CMS. This issue has been fixed in version 2.3.4.

Affected packages

Related vulnerabilities

• GHSA-34p4-7w83-35g2 Formwork Improperly Managed Privileges in User creation Same vulnerability
• GHSA-7j46-f57w-76pj Formwork CMS has Stored Cross-Site Scripting Vulnerebility in Blog Tags Also affects getformwork/formwork
• CVE-2025-65956 Formwork CMS has Stored Cross-Site Scripting Vulnerebility in Blog Tags Also affects getformwork/formwork
• CVE-2026-114658 Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability… CWE-269
• CVE-2026-53614 util-linux is a random collection of Linux utilities. CWE-269
• CVE-2026-95837 containerd is an open-source container runtime. CWE-269
• CVE-2026-63349 AnyIO is a high level asynchronous concurrency and networking framework that works on top… CWE-269
• CVE-2026-92957 vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating… CWE-269