Open Forms, a platform that enables the creation and publication of smart forms, contains an access control flaw that allows a logged‑in user to view submission details that were not intended for them. The flaw is triggered when the cosigner receives an email or deep‑link containing a submission reference; an attacker can guess or alter this reference to retrieve arbitrary submissions. The vulnerability is classified as CWE‑284: Improper Access Control, indicating that legitimate users are able to bypass intended access restrictions.

The affected product is Open Forms from maykinmedia. All releases prior to 3.3.13 for the 3.3.x line and prior to 3.4.5 for the 3.4.x line are vulnerable. Versions 3.3.13 and 3.4.5, and any later releases, contain the fix.

The CVSS score of 6.5 places the vulnerability in the moderate severity range; however, the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack requires a legitimate authenticated session, after which an attacker can guess a submission reference or tamper with the cosign link to gain unauthorized access to other users’ submission data. No publicly known exploit is available at this time, but the entry is remediated by updating the product to the patched versions.