{"id":"CVE-2026-123148","kind":"vulnerability","aliases":["CVE-2026-123148"],"related":[],"title":"TMS IvyForms: missing authorization lets users reach restricted access controls","description":"Missing Authorization vulnerability in TMS IvyForms ivyforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IvyForms: from n/a through 1.5.1.","summary":"IvyForms, a form plugin from TMS, has a missing authorization check that lets access control settings be exercised incorrectly. The description says affected versions run through 1.5.1, and the sources give no further detail on what an attacker can read or change.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ivyforms","package","tms","wordpress"],"not_affected_if":[],"how_to_check":"- Check the installed IvyForms version in the WordPress plugin list or the product's own version field: unknown if the sources do not say which path applies.\n- Compare the installed version against `1.5.1`; the sources say versions through 1.5.1 are affected.","fix":null,"status":"open","published_at":"2026-11-07T11:17:00+00:00","first_seen_at":"2026-11-07T11:46:53+00:00","triaged_at":"2026-11-07T11:48:26+00:00","updated_at":"2026-11-07T11:48:26+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-07T11:48:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"TMS IvyForms: missing authorization lets users reach restricted access controls","impact":"medium","summary":"IvyForms, a form plugin from TMS, has a missing authorization check that lets access control settings be exercised incorrectly. The description says affected versions run through 1.5.1, and the sources give no further detail on what an attacker can read or change.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ivyforms","wordpress","tms"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown: sources do not state what data or actions are exposed","analyst_note":"Find the vendor advisory or the NVD entry for CVE-2026-123148 to confirm fixed version, required role and what access is granted.","how_to_check":"- Check the installed IvyForms version in the WordPress plugin list or the product's own version field: unknown if the sources do not say which path applies.\n- Compare the installed version against `1.5.1`; the sources say versions through 1.5.1 are affected.","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Sites or applications running IvyForms at version 1.5.1 or earlier are described as affected. The sources do not say which roles or configurations are needed to reach the flaw, so unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000678,"input_tokens":4210,"output_tokens":513,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123148':13A,16A '-2026':12A,15A '1.5.1':47B,84C 'access':9A,34B,74C 'affect':43B,79C 'allow':70C 'attack':58B 'author':4A,30B,64C 'chang':62B 'check':31B 'configur':73C 'control':10A,35B,75C 'cve':11A,14A 'descript':41B 'detail':54B 'exercis':38B 'exploit':71C 'form':23B 'give':51B 'incorrect':39B,72C 'issu':78C 'ivyform':2A,17B,21B,68C,69C,80C 'let':5A,33B 'levels.this':77C 'miss':3A,29B,63C 'n/a':82C 'packag':18B 'plugin':24B 'reach':7A 'read':60B 'restrict':8A 'run':45B 'say':42B 'secur':76C 'set':36B 'sourc':50B 'tms':1A,19B,26B,67C 'user':6A 'version':44B 'vulner':65C 'wordpress':20B","nicknames":[],"mitigations":[],"who_affected":"Sites or applications running IvyForms at version 1.5.1 or earlier are described as affected. The sources do not say which roles or configurations are needed to reach the flaw, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ivyforms","medium","package","tms","wordpress"],"campaign_type":null,"search_a":"'-123148':13A,16A '-2026':12A,15A 'access':9A 'author':4A 'control':10A 'cve':11A,14A 'ivyform':2A 'let':5A 'miss':3A 'reach':7A 'restrict':8A 'tms':1A 'user':6A","search_b":"'1.5.1':47B 'access':34B 'affect':43B 'attack':58B 'author':30B 'chang':62B 'check':31B 'control':35B 'descript':41B 'detail':54B 'exercis':38B 'form':23B 'give':51B 'incorrect':39B 'ivyform':17B,21B 'let':33B 'miss':29B 'packag':18B 'plugin':24B 'read':60B 'run':45B 'say':42B 'set':36B 'sourc':50B 'tms':19B,26B 'version':44B 'wordpress':20B","search_c":"'1.5.1':84C 'access':74C 'affect':79C 'allow':70C 'author':64C 'configur':73C 'control':75C 'exploit':71C 'incorrect':72C 'issu':78C 'ivyform':68C,69C,80C 'levels.this':77C 'miss':63C 'n/a':82C 'secur':76C 'tms':67C 'vulner':65C","first_public_at":"2026-11-07T11:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123148","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123148","severity":null,"published_at":"2026-11-07T11:17:00+00:00","modified_at":"2026-11-07T11:17:00+00:00","first_seen_at":"2026-11-07T11:46:53+00:00","fetched_at":"2026-11-07T11:46:53+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}