CVE-2026-42377

Full vulnerability record from the local CVENow database.

Description

Missing Authorization vulnerability in Brainstorm Force SureForms Pro allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SureForms Pro: from n/a through 2.8.0.

Severity

HIGH

CVSS score

7.3 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-04-29 08:16:18.337000

Last modified

2026-10-26 00:10:00.150000

View original CVE JSON

{
  "id": "CVE-2026-42377",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-29T08:16:18.337",
  "lastModified": "2026-10-26T00:10:00.150",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Missing Authorization vulnerability in Brainstorm Force SureForms Pro allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects SureForms Pro: from n/a through 2.8.0."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad por falta de autorización en Brainstorm Force SureForms Pro permite la explotación de niveles de seguridad de control de acceso configurados incorrectamente.\n\nEste problema afecta a SureForms Pro: desde n/a hasta 2.8.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Brainstorm Force",
          "product": "SureForms Pro",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "n/a",
              "lessThanOrEqual": "2.8.0",
              "versionType": "custom",
              "status": "affected",
              "changes": [
                {
                  "at": "2.8.1",
                  "status": "unaffected"
                }
              ]
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-29T13:15:57.174460Z",
          "id": "CVE-2026-42377",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://patchstack.com/database/wordpress/plugin/sureforms-pro/vulnerability/wordpress-sureforms-pro-plugin-2-8-0-broken-access-control-vulnerability?_s_id=cve",
      "source": "[email protected]"
    }
  ]
}