GHSA-34p4-7w83-35g2
High · 8.8CVSS
8.8
EPSS
—
Published
Feb 19, 2026
CISA due date
—
The record
Formwork Improperly Managed Privileges in User creation
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | getformwork/formwork | 2.0.0 | 2.3.4 |
Related vulnerabilities
- CVE-2026-27198 Formwork is a flat file-based Content Management System (CMS). Same vulnerability
- GHSA-7j46-f57w-76pj Formwork CMS has Stored Cross-Site Scripting Vulnerebility in Blog Tags Also affects getformwork/formwork
- CVE-2025-65956 Formwork CMS has Stored Cross-Site Scripting Vulnerebility in Blog Tags Also affects getformwork/formwork
- CVE-2026-114658 Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability… CWE-269
- CVE-2026-53614 util-linux is a random collection of Linux utilities. CWE-269
- CVE-2026-95837 containerd is an open-source container runtime. CWE-269
- CVE-2026-63349 AnyIO is a high level asynchronous concurrency and networking framework that works on top… CWE-269
- CVE-2026-92957 vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating… CWE-269