CVE-2026-107431: Missing Authorization in Crocoblock JetFormBuilder

The vulnerability CVE-2026-107431 in Crocoblock JetFormBuilder is due to missing authorization controls, which means that certain actions or resources may be accessible without proper access checks. This issue affects all versions from the initial release through 3.6.6. The CVSS v3.1 base score is 7.5, with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or integrity impact, but high impact on availability. There is no vendor advisory or patch information available, and no known exploits have been reported.

The vulnerability can lead to a high impact on availability of the affected system or service, potentially causing denial of service or disruption. There is no impact on confidentiality or integrity. Because no privileges or user interaction are required, the vulnerability could be exploited remotely by an unauthenticated attacker. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations in JetFormBuilder to prevent unauthorized access. Monitor vendor channels for updates and apply patches promptly once released.