The vulnerability in OpnForm involves the use of Hashids with an empty default salt to generate editable-submission secrets from sequential row identifiers. Because the salt is empty, attackers can compute valid hashes for any submission without authentication. This allows unauthorized access to other respondents' full submission data through the submission-fetch endpoint and the ability to overwrite submissions by providing predicted hashes to the answer endpoint. The weakness corresponds to CWE-340 (Use of insufficiently random values).

An unauthenticated attacker can fully compromise the confidentiality and integrity of submission data by reading other respondents' submissions and overwriting them. The vulnerability does not impact availability. The CVSS 3.1 score is 9.1 (critical), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, users should consider restricting access to submission endpoints or implementing additional authentication controls to prevent unauthorized access and modification.