CVE-2026-75106: OpnForm Authentication Bypass Vulnerability

CVE-2026-75106 Overview

CVE-2026-75106 affects OpnForm, an open-source form-building application. The application derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt. Unauthenticated attackers can compute the Hashid for any submission by iterating sequential integer IDs. This allows attackers to read other respondents' full submission data through the submission-fetch endpoint. Attackers can also overwrite existing submissions by supplying predicted hashes to the answer endpoint. The vulnerability is classified as CWE-340: Generation of Predictable Numbers or Identifiers and is fixed in OpnForm 2.0.2.

Critical Impact
Unauthenticated attackers can enumerate and read all form submissions and overwrite arbitrary submission content through predictable identifier generation.

Affected Products

OpnForm versions prior to 2.0.2
OpnForm PublicFormController submission endpoints
OpnForm SubmissionUrlService identifier generation

Discovery Timeline

2026-08-17 - CVE-2026-75106 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-75106

Vulnerability Analysis

OpnForm uses the Vinkla Hashids library to encode submission row IDs into public identifiers used by editable submission URLs. Hashids is an obfuscation library, not a cryptographic function. Without a configured salt, Hashids produces a deterministic mapping that any attacker can reproduce locally.

The SubmissionUrlService::getSubmissionIdentifier() method returned Hashids::encode($submission->id) when no public_id existed on the submission. Because submission IDs are sequential auto-increment integers, an attacker computes the Hashid for id=1, id=2, id=3, and so on, then submits those values to the submission-fetch endpoint. The endpoint treats a valid Hashid as sufficient authorization, returning the full submission payload including personally identifiable information collected by the form.

The answer endpoint uses the same identifier scheme, allowing an attacker with a predicted hash to overwrite the target submission's data.

Root Cause

The root cause is reliance on an obscurity-based identifier scheme for access control. Hashids with an empty salt is fully reversible and does not provide the unpredictability required for capability tokens. This maps to CWE-340: Generation of Predictable Numbers or Identifiers.

Attack Vector

The attack requires no authentication and no user interaction. An attacker installs the Hashids library locally, encodes sequential integers using the default configuration, and issues HTTP requests to the OpnForm submission-fetch and answer endpoints using each generated identifier.

php

// Vulnerable identifier generation (pre-patch)
public static function getSubmissionIdentifier(FormSubmission $submission): string
{
    return $submission->public_id ?? Hashids::encode($submission->id);
}

// Patched identifier generation - uses UUIDs
public static function getSubmissionIdentifier(FormSubmission $submission): string
{
    if (!$submission->public_id) {
        $publicId = Str::uuid()->toString();
        $updated = FormSubmission::query()
            ->whereKey($submission->id)
            ->whereNull('public_id')
            ->update(['public_id' => $publicId]);

        $submission->public_id = $updated ? $publicId : $submission->refresh()->public_id;
    }

    return $submission->public_id;
}

Source: OpnForm commit 6c67ff0

Detection Methods for CVE-2026-75106

Indicators of Compromise

Sequential enumeration patterns in web server logs targeting OpnForm submission-fetch endpoints from a single client
High-volume GET requests to editable-submission URLs where identifiers decode to consecutive integer IDs
Unexpected PATCH or POST requests to the answer endpoint modifying submissions the requester did not create
Submission records with modification timestamps that do not correlate to legitimate respondent activity

Detection Strategies

Parse OpnForm access logs and decode submission identifiers using default Hashids parameters to identify iteration patterns
Alert on any single source IP requesting more than a threshold of distinct submission identifiers within a short time window
Correlate submission read events with the originating IP of the form completion to flag mismatches

Monitoring Recommendations

Ingest OpnForm application and web server logs into a centralized logging platform for retention and correlation
Monitor for spikes in 4xx and 2xx responses on submission endpoints that indicate enumeration attempts
Track submission update events and alert when the modifying identity does not match the original submitter

How to Mitigate CVE-2026-75106

Immediate Actions Required

Upgrade OpnForm to version 2.0.2 or later, which replaces Hashids-derived identifiers with UUIDs stored in a public_id column
Audit existing submissions for signs of unauthorized access by reviewing web server logs for sequential identifier enumeration
Rotate identifiers for existing submissions by triggering the patched getSubmissionIdentifier() logic to assign UUIDs
Notify affected respondents if evidence of unauthorized submission access is found during the audit

Patch Information

The fix is available in OpnForm release v2.0.2. The security patch removes the Vinkla\Hashids\Facades\Hashids dependency from PublicFormController and SubmissionUrlService and generates UUIDs via Str::uuid() for the public_id column. Additional details are available in the VulnCheck advisory and the OpnForm issue #1259.

Workarounds

If immediate patching is not feasible, configure a strong random Hashids salt in the application .env and invalidate existing editable submission links
Restrict access to OpnForm submission endpoints behind an authenticated reverse proxy or IP allow-list for internal deployments
Add rate limiting on the submission-fetch and answer endpoints to slow enumeration attempts

bash

# Upgrade OpnForm via git and composer
git fetch --tags
git checkout v2.0.2
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan config:cache