FormCms Improper Access Control Vulnerability in Schema History Endpoint Allowing Unauthenticated Data Access

A vulnerability in FormCms version 0.5.4 allows unauthenticated attackers to access historical schema data through the /api/schemas/history/[schemaId] endpoint. If a valid schemaId is known or guessed, the entire schema history and associated definitions can be retrieved without authentication or authorization.

Impact

Exploitation of this vulnerability leads to unauthorized access to sensitive historical schema data, including complete schema definitions, which could be misused for malicious purposes or to gain an unfair advantage.

Remediation

Users can upgrade to FormCms version 0.5.5, where this vulnerability has been addressed.