CVE-2026-28140 Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions

Description

Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions.

Affected products and versions

Product	Affected versions	Fixed in
JetFormBuilder 3.6	earliest → 3.6.4.1	No fix stated

Other CVEs of JetFormBuilder

The 7 CVEs of JetFormBuilder →

CVE-2026-102391 Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.4 versions 7.1 High CVE-2026-54196 Incorrect Privilege Assignment vulnerability in Jetmonsters JetFormBuilder allows Privilege Escalation 6.8 Medium CVE-2026-54195 Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions 7.1 High CVE-2026-32525 Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters JetFormBuilder jetformbuilder… 9.9 Critical