CVE-2026-27198: Verified Repro With Script Download

Q: How does the Formwork privilege-escalation attack work?

An authenticated user holding only the editor role sends a request to create a new user account with administrative privileges; because the account-creation endpoint doesn't verify that the requester itself has administrator privileges, the new administrator account is created, giving the editor full administrative access to the CMS.

Q: Which Formwork versions are affected by CVE-2026-27198, and where is it fixed?

Formwork versions >= 2.0.0 and <= 2.3.3 are affected; it is fixed in 2.3.4.

Q: How severe is CVE-2026-27198?

It is rated high severity - any authenticated editor-role account can create a new administrator account, resulting in full administrative access and CMS compromise.

Q: How can I reproduce CVE-2026-27198?

Download the verified script from this page and run it in an isolated environment against Formwork >=2.0.0, <=2.3.3; log in as an editor-role user and send a user-creation request specifying administrative privileges, then verify the new account has full admin access, and confirm 2.3.4 rejects the escalation.

Pruva

CVE-2026-27198: Verified Repro With Script Download

CVE-2026-27198: Formwork CMS Improper Privilege Management in User Creation

Download script Open in Codespaces

CVE-2026-27198 is verified against getformwork/formwork · composer. Affected versions: >= 2.0.0, <= 2.3.3. Fixed in 2.3.4. This high reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00111.

REPRO-2026-00111 getformwork/formwork · composer Feb 20, 2026 CVE entry ↗ .txt

Severity

HIGH

CVSS

8.8

Reproduced in

12m 42s

Tool calls

119

Spend

$0.44

01 · Overview

What Is CVE-2026-27198?

CVE-2026-27198 is a high-severity improper privilege management vulnerability in Formwork CMS: the application fails to enforce role-based authorization during account creation. Pruva reproduced it (reproduction REPRO-2026-00111).

02 · Severity & CVSS

CVE-2026-27198 Severity & CVSS Score

CVE-2026-27198 is rated high severity, with a CVSS base score of 8.8 out of 10.

HIGH threat level

8.8 / 10 CVSS base

Weakness CWE-269 — Improper Access Control (Generic)

High — serious impact or readily exploitable. Prioritize remediation.

03 · Affected Versions

Affected getformwork/formwork Versions

getformwork/formwork · composer versions >= 2.0.0, <= 2.3.3 are affected.

05 · How to Reproduce

Download script Open in Codespaces →

$ pruva-verify REPRO-2026-00111

or

curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00111/artifacts/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh

Run in a VM or disposable container. This exploits a real vulnerability.

06 · Proof of Reproduction

Proof of Reproduction for CVE-2026-27198

Reproduced by Pruva's autonomous agents — 119 tool calls over 13 min. Full root-cause analysis and the complete transcript are below.

How the agent worked 316 events · 119 tool calls · 13 min

13 minDuration

119Tool calls

64Reasoning steps

316Events

1Dead-ends

Agent activity over 13 min

Support

17

Repro

159

Variant

136

0:0012:42

Root Cause and Exploit Chain for CVE-2026-27198

Application fails to enforce role-based authorization during account creation. An authenticated user with editor role can create new accounts with administrative privileges, leading to full administrative access and CMS compromise.

CVE-2026-27198 Reproduction Transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.

Full session Replay every step — scrub the timeline or play it back.

Event 1/40

0:00

support

repro

2:40

0:00

session startedaccounts/fireworks/models/kimi-k2p5 · ghsa-34p4-7w83-35g2 · ghsa-34p

0:15

0:28

0:57

0:58

1:00

web search

1:23

extract_facts

no facts extracted

1:25

supportrepro

2:01

2:06

2:09

2:22

2:28

web search

2:38

2:40

$

mkdir -p /root/.pruva/runs/ghsa-34p4-7w83-35g2_20260220-144426/formwork && cd /root/.pruva/runs/ghsa-34p4-7w83-35g2_20260220-144426/formwork && git clone --depth 1 --branch 2.3.3 https://github.com/getformwork/formwork.git vulnerable 2>&1

2.0s✓

Cloning into 'vulnerable'...
Note: switching to '69b7f934abade9674c4af104d1713fb2735ef7ee'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by switching back to a branch.

If you want to create a new branch to retain commits you create, you may

Artifacts and Evidence for CVE-2026-27198

Scripts, logs, diffs, and output captured during the reproduction.

No artifacts available

08 · How to Fix

How to Fix CVE-2026-27198

Upgrade getformwork/formwork · composer to 2.3.4 or later.

Coming soon

Step-by-step mitigation and hardening guidance for CVE-2026-27198 — configuration checks, workarounds where no patch exists, and how to verify you're protected — is on the way.

10 · FAQ

FAQ: CVE-2026-27198

How does the Formwork privilege-escalation attack work?

An authenticated user holding only the editor role sends a request to create a new user account with administrative privileges; because the account-creation endpoint doesn't verify that the requester itself has administrator privileges, the new administrator account is created, giving the editor full administrative access to the CMS.

Which Formwork versions are affected by CVE-2026-27198, and where is it fixed?