CVE-2026-89286: FormFlow for GoHighLevel (GHL) 0 through 1.0.0

Affected technology

FormFlow for GoHighLevel (GHL) · 0 through 1.0.0
Vendor not specified by the source

Description’s affected range: through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory

Component: Not specified by the source

What an attacker can do

Unauthenticated attackers can read its contents, which include connected-CRM identifiers and, on sites that have linked the integration, a third-party access token.