Form.io Application Security Review

Every Form.io project ships four default Roles, and Submission Access is switched off for every form until a role is deliberately granted create_own or create_all.

Why Form.io findings sit in your role configuration, not the form builder

Form.io’s Roles and Permissions model grants every new project four default Roles, including Anonymous and Everyone, and Submission Access is disabled on every form until a role is explicitly given create_own or create_all. We test which roles actually hold that access on each form, and check for the documented interaction where a role granted update_all also receives create_all on the same Submission collection, whether or not that was intended. Form definitions themselves are readable by every role by default, so we check what a form’s own JSON schema discloses about validation logic and hidden fields before a submission is ever made.

Actions run server-side on submission, and a Webhook Action forwards a configurable payload to an external Request URL with an optional Basic Auth header or additional custom headers, transformable with custom JavaScript before it leaves Form.io. We test where each webhook actually points, whether the receiving endpoint enforces the authentication the action was configured with, and whether the transform script leaks more of the submission than the destination needs. Role Assignment Actions that add or remove a Role automatically on submission, commonly used for approval-style registration flows, get the same scrutiny, since the trigger condition is what decides who ends up privileged.

Authentication is delegated: OAuth, SAML or LDAP logins are mapped onto Form.io Roles after the external provider authenticates the user, and each Form.io session runs on a JWT carrying a session ID in its jti claim, invalidated project-wide on logout. We test whether that role mapping can be forced to a higher role than the provider intended, and how the API’s temporary-token pattern for exporting submission data is scoped. Field Level Encryption at rest is part of Form.io’s separately licensed Security Module rather than a default, so we confirm whether it is active before judging how sensitive fields are stored.