Hello,
we have a contact form where anyone can contact us by providing their firstname, lastname, email, phone number. When the provided email address matches an existing contact the contact’s fields are updated. This update happens without further authorization. That means a malicious actor who knows a contact’s email address can change their data.
Is there any protection against such potential attacks? Or is that the way how HubSpot works?
Hi @sse,
@sse wrote:
Or is that the way how HubSpot works?
This. There is indeed no way of preventing this from happeningin the forms settings. If someone enters an email address into a form, HubSpot will definitely and automatically without exception update the form fields.
The only feasible workaround that I’m aware of requires a Professional subscription with workflows and a duplicate of each form field.
For example, you would create “First name (use in forms)”, “Last name (use in forms)” etc. These are the fields you… use in forms.
In a contact-based workflow, you would then enroll contacts, where “First name (use in forms)” is known and where “First name” is unknown. Only then you would copy the value from “First name (use in forms)” into “First name”. In all other cases, the workflow wouldn’t do anything. It adds redundancy and it’s a boring exercise in cloning but it gets the job done.
Without a Professional subscription, it wouldn’t be possible to automatically review and copy. It would have to be a manual comparison of the fields.
Best regards!
Thanks Karsten for the response and the proposed workaround.
FYI, here is a related feature request: https://community.hubspot.com/t5/HubSpot-Ideas/Being-able-to-disable-automatic-field-updating-from-outside/idi-p/517338