CVE-2025-62738 describes a missing authorization vulnerability in mmattax Formstack Online Forms up to version 2.0.2. The issue arises from incorrectly configured access control security levels, which allow unauthorized users to perform actions that should require authorization. The CVSS score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity loss without confidentiality or availability impact. No patch or vendor advisory is currently provided, and the product is not a cloud service.

The vulnerability allows unauthorized users to modify data within the affected Formstack Online Forms application, impacting data integrity. There is no impact on confidentiality or availability. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations on Formstack Online Forms to ensure proper authorization enforcement. Monitor for vendor updates regarding patches or official mitigations.