Executive brief
Formio is a popular form-building and data management platform used by many organizations. A flaw in how the software validates request paths allows attackers to bypass access controls and retrieve sensitive data from protected API endpoints without proper authentication. This could lead to unauthorized disclosure of customer records, configurations, or other sensitive information stored in Formio.
Technical details
The vulnerability is an authorization bypass due to improper path handling (CWE-178). Attackers can craft specially formed request paths to bypass authorization checks and access protected API endpoints without authentication. The flaw affects the path validation logic that determines whether a request should be permitted. The attack requires only network access and no user interaction. Successful exploitation allows an unauthenticated attacker to retrieve data from endpoints that should be protected, resulting in unauthorized information disclosure. Patches have been released: formio versions 3.5.7 and 4.4.3, and formio-server versions 8.5.8 and 9.4.2.
Affected products
- Formio formio < 3.5.7, 4.0.0-rc.1 to < 4.4.3
- Formio formio-server < 8.5.8, 9.0.0 to < 9.4.2
Timeline
- 2025-05-22: disclosed: Vulnerability discovered
- 2025-05-30: patched: Fix released
- 2025-12-10: advisory: Publicly disclosed via GitHub Security Advisory