Open Forms CVE-2025-64515 Prefill Data Tampering via Dynamic Read-Only Bypass

From this webpage screenshot, the following key information about the vulnerability can be obtained: Vulnerability Title: Prefill data in read-only components could be tampered with in certain circumstances Severity: Moderate Affected Versions: < 3.2.7, < 3.3.3, 3.1.x, 3.0.x, 2.8.x (and likely any older version) Fixed Versions: 3.2.7, 3.3.3 CVE ID: CVE-2025-64515 CVSS v3 Score: 4.3 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Required Privileges: Low - User Interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: Low - Availability: None Vulnerability Description: Open Forms supports retrieving "real" data via its prefill mechanism and assigning it to form fields as default values. The current recommended method to prevent users from changing data is to mark form fields as read-only (disabled in JSON). During final input validation, Open Forms checks for tampering in these marked fields. However, if a field is dynamically marked as read-only via form logic, this is not detected during the final validation step. Attackers can bypass this validation using tools like Postman or cURL. Impact: Form fields with prefill data that are dynamically set to read-only/disabled can be intentionally modified by malicious users, allowing them to alter data they should not be permitted to change. For regular users, form fields marked as read-only cannot be modified via the user interface. Fixes: The vulnerability has been patched in the following maintained versions of Open Forms: - 3.3.3 - 3.2.7 The patch can be applied via submission to older versions. Workaround: It is recommended to reverse the form logic: initially mark form fields as read-only and enable them via logic, rather than disabling them dynamically. Discovery Information: Discovered during a penetration test conducted by the city of Almelo.

Goal Reached Thanks to every supporter — we hit 100%!

Open Forms CVE-2025-64515 Prefill Data Tampering via Dynamic Read-Only Bypass

More from this source