medium6.9
CVE-2025-55797
FormCMS has an improper access control vulnerability in the /api/schemas/history/[schemaId] endpoint
Impact
An improper access control vulnerability in FormCms v0.5.4 in the /api/schemas/history/[schemaId] endpoint allows unauthenticated attackers to access historical schema data if a valid schemaId is known or guessed.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | FormCMS | <= 0.5.4 | 0.5.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Formcms | Formcms | Version 0.5.4 |