CVE-2026-27198: Formwork Package Privilege Escalation Vulnerability
Summary
CVE-2026-27198: Formwork Improperly Managed Privileges in User creation. Affects getformwork/formwork versions >= 2.0.0, < 2.3.4. Fixed in 2.3.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Formwork is an open-source content management system (CMS) designed for building websites and managing content efficiently. It offers features such as user role management, customizable templates, and a user-friendly interface. However, a critical vulnerability has been identified in its user account creation process, where role-based authorization is not properly enforced, allowing unauthorized privilege escalation.
Vulnerability Detail
The vulnerability arises from the application's failure to enforce role-based authorization during the account creation process. While the system checks if the specified role exists, it does not verify whether the current user has the necessary privileges to assign high-level roles, such as admin. This oversight allows an authenticated user with an editor role to create new accounts with administrative privileges, leading to full control over the CMS. The ramifications include unauthorized access to sensitive data, modification of system settings, and the ability to manage user accounts, including those of legitimate administrators.
How To Fix
Minimum fixed version
2.3.4
This is the first release that contains the fix.
composer require getformwork/formwork:2.3.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict the ability to create new user accounts to only those users with administrative privileges. This can be done by modifying the user creation logic in your application to check the current user's role before allowing account creation.
Conclusion
The CVE-2026-27198 vulnerability in the Formwork package poses a significant risk by allowing unauthorized privilege escalation during user account creation. It is crucial to update to the patched version 2.3.4 to mitigate this risk and protect your CMS from potential exploitation.
See every vulnerability recorded for getformwork/formwork →
FAQ
CVE-2026-27198 is a vulnerability in the Formwork package that allows authenticated users with lower privileges to create accounts with administrative access.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without any signup.
Exploitation of this vulnerability can lead to full administrative control over the CMS, unauthorized access to sensitive data, and the ability to modify or delete user accounts.
Yes, the vulnerability has been patched in Formwork version 2.3.4. It is recommended to update to this version or later.
The CVSS score for this vulnerability is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for getformwork/formwork.
