CVE-2025-64515

Open Forms allows users create and publish smart forms. Prior to versions 3.2.7 and 3.3.3, forms where the prefill data fields are dynamically set to readonly/disabled can be modified by malicious users deliberately trying to modify data they're not supposed to. For regular users, the form fields are marked as readonly and cannot be modified through the user interface. This issue has been patched in versions 3.2.7 and 3.3.3.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/open-formulieren/open-forms/blob/bcf2dc54c695fb7c8c58712627d82c4b766248b6/CHANGELOG.rst#327-2025-11-18	Release Notes
https://github.com/open-formulieren/open-forms/blob/bcf2dc54c695fb7c8c58712627d82c4b766248b6/CHANGELOG.rst#333-2025-11-18	Release Notes
https://github.com/open-formulieren/open-forms/security/advisories/GHSA-cp63-63mq-5wvf	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:maykinmedia:open_forms::::::::
	cpe:2.3:a:maykinmedia:open_forms::::::::

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Open Forms permite a los usuarios crear y publicar formularios inteligentes. Versiones anteriores a las versiones 3.2.7 y 3.3.3, los formularios donde los campos de datos de precarga se configuran dinámicamente como de solo lectura/deshabilitados pueden ser modificados por usuarios malintencionados que intentan deliberadamente modificar datos que no deberían. Para los usuarios habituales, los campos del formulario están marcados como de solo lectura y no pueden ser modificados a través de la interfaz de usuario. Este problema ha sido parcheado en las versiones 3.2.7 y 3.3.3.

Information

Published : 2025-11-18 23:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-64515

Mitre link : CVE-2025-64515

CVE.ORG link : CVE-2025-64515

JSON object : View

Products Affected

maykinmedia

open_forms

CWE

CWE-20

Improper Input Validation

NVD-CWE-noinfo

{"id": "CVE-2025-64515", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64515", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-19T17:00:52.614729Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "open-formulieren", "product": "open-forms", "versions": [{"status": "affected", "version": ">= 3.3.0, < 3.3.3"}, {"status": "affected", "version": "< 3.2.7"}]}]}], "published": "2025-11-18T23:15:55.690", "references": [{"url": "https://github.com/open-formulieren/open-forms/blob/bcf2dc54c695fb7c8c58712627d82c4b766248b6/CHANGELOG.rst#327-2025-11-18", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/open-formulieren/open-forms/blob/bcf2dc54c695fb7c8c58712627d82c4b766248b6/CHANGELOG.rst#333-2025-11-18", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/open-formulieren/open-forms/security/advisories/GHSA-cp63-63mq-5wvf", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Open Forms allows users create and publish smart forms. Prior to versions 3.2.7 and 3.3.3, forms where the prefill data fields are dynamically set to readonly/disabled can be modified by malicious users deliberately trying to modify data they're not supposed to. For regular users, the form fields are marked as readonly and cannot be modified through the user interface. This issue has been patched in versions 3.2.7 and 3.3.3."}, {"lang": "es", "value": "Open Forms permite a los usuarios crear y publicar formularios inteligentes. Versiones anteriores a las versiones 3.2.7 y 3.3.3, los formularios donde los campos de datos de precarga se configuran din\u00e1micamente como de solo lectura/deshabilitados pueden ser modificados por usuarios malintencionados que intentan deliberadamente modificar datos que no deber\u00edan. Para los usuarios habituales, los campos del formulario est\u00e1n marcados como de solo lectura y no pueden ser modificados a trav\u00e9s de la interfaz de usuario. Este problema ha sido parcheado en las versiones 3.2.7 y 3.3.3."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:maykinmedia:open_forms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6357DA53-9F3D-4C21-B0C3-66637A1689B6", "versionEndExcluding": "3.2.7"}, {"criteria": "cpe:2.3:a:maykinmedia:open_forms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2833EAC3-CAC0-4F95-ADC7-ED250653BF3B", "versionEndExcluding": "3.3.3", "versionStartIncluding": "3.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}