---
id: CVE-2026-107856
title: >-
  CiviForm simplifies applications for government benefits programs by reusing
  applicant data across multiple benefit applications
summary: >-
  CiviForm simplifies applications for government benefits programs by reusing
  applicant data across multiple benefit applications. Prior to 3.33.0, GET
  /admin/tiDash/editClientForm/:accountId verifies that the requester is a
  Trusted Inter…
severity: medium
cvss: 4.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N'
cwe:
  - CWE-639
published: '2026-10-09'
updated: '2026-10-09'
sourceUpdated: '2026-10-09T21:17:03.387'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-107856'
references:
  - url: >-
      https://github.com/civiform/civiform/commit/ccfd84ff2d9ee6570a1b1524c7ae3a3732e1839e
    label: security-advisories@github.com
  - url: 'https://github.com/civiform/civiform/pull/13635'
    label: security-advisories@github.com
  - url: 'https://github.com/civiform/civiform/releases/tag/v3.33.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/civiform/civiform/security/advisories/GHSA-qv7c-9hjr-9rv7
    label: security-advisories@github.com
tags:
  - nvd
ingestedAt: '2026-10-09T22:14:52.100Z'
---

## Overview

CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditClientForm performs a raw lookupAccount(accountId) without confirming that the citizen account belongs to the requester's trustedIntermediaryGroup. An authenticated Trusted Intermediary can enumerate accountId values and read the applicant display name, including the citizen's name and email address, for accounts outside the intermediary's group. This issue is fixed in version 3.33.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.