CiviForm stores applicant data and reuses it across multiple benefit applications. A Trusted Intermediary can perform GET /admin/tiDash/editClientForm/:accountId to retrieve a citizen's display name and email. The implementation checks that the caller is a Trusted Intermediary but fails to confirm that the target account belongs to the caller’s trustedIntermediaryGroup. This IDOR flaw allows authenticated intermediaries to enumerate arbitrary account IDs and read personal information for citizens outside their group. The weakness is a classic Missing Authorization error, aligned with CWE-639.

The vulnerability affects all CiviForm releases prior to 3.33.0. The product is Civiform, a government benefits application system. Versions < 3.33.0 are impacted; the fix was released with version 3.33.0.

The CVSS score is 4.5, indicating a moderate impact. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers need to authenticate as a Trusted Intermediary to reach the endpoint, making exploitation dependent on privileged access. Once authenticated, enumeration of account identifiers is trivial, enabling disclosure of sensitive identifiers for many users.