Skip to content
Verified reproduction

CVE-2026-27198: Formwork CMS Improper Privilege Management in User Creation

Download script Open in Codespaces

CVE-2026-27198 is verified against getformwork/formwork · composer affected versions: >= 2.0.0, <= 2.3.3 fixed version: 2.3.4 This high reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00111.

REPRO-2026-00111 getformwork/formwork · composer Feb 20, 2026 CVE entry .txt
Severity HIGH
Confidence HIGH
Reproduced in 12m 42s
Tool calls 119
Spend $0.44
Affected >= 2.0.0, <= 2.3.3
Fixed in 2.3.4
01 · Reproduce
Download script Open in Codespaces →
$ pruva-verify REPRO-2026-00111
or curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00111/artifacts/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh
Run in a VM or disposable container. This exploits a real vulnerability.
02 · The vulnerability

Application fails to enforce role-based authorization during account creation. An authenticated user with editor role can create new accounts with administrative privileges, leading to full administrative access and CMS compromise.

03 · Root cause 
Application fails to enforce role-based authorization during account creation. An authenticated user with editor role can create new accounts with administrative privileges, leading to full administrative access and CMS compromise.
04 · Reproduction transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.

Loading session...
05 · Artifacts

Scripts, logs, diffs, and output captured during the reproduction.

No artifacts available