Read the docs
TI-2026-34846 Aliases CVE-2026-47266GHSA-pgxq-p76c-x9cg

Formie: Unauthenticated front-end submission editing can overwrite existing submissions

Priority MEDIUM 43CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.21 and 3.1.26, unauthenticated users could modify existing submissions by posting a known or guessed submission ID to formie/submissions/save-submission. This vulnerability is fixed in 2.2.21 and 3.1.26.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00312 24th percentileScored 2026-11-07
Fix Fixed formie (verbb): 2.2.21, 3.1.26verbb/formie (Packagist): 3.1.26, 2.2.21

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
verbbformiebefore 2.2.21; 3.0.0-beta.1 to before 3.1.262.2.21, 3.1.26Patch availableCNA
—verbb/formie (Packagist)3.0.0 to before 3.1.263.1.26Patch availableGHSA-pgxq-p76c-x9cg
—verbb/formie (Packagist)before 2.2.212.2.21Patch availableGHSA-pgxq-p76c-x9cg
  • formie Vendorverbb Affected before 2.2.21; 3.0.0-beta.1 to before 3.1.26 Fixed in 2.2.21, 3.1.26 Patch available CNA
  • verbb/formie (Packagist) Vendor— Affected 3.0.0 to before 3.1.26 Fixed in 3.1.26 Patch available GHSA-pgxq-p76c-x9cg
  • verbb/formie (Packagist) Vendor— Affected before 2.2.21 Fixed in 2.2.21 Patch available GHSA-pgxq-p76c-x9cg

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:verbb:formie:*:*:*:*:*:*:*:*——verbb
  • cpe:2.3:a:verbb:formie:*:*:*:*:*:*:*:* Versions — — ·verbb

Remediation

  • Fix · CNA formie (verbb) Fixed in 2.2.21, 3.1.26
  • Fix · GHSA-pgxq-p76c-x9cg verbb/formie (Packagist) Fixed in 3.1.26 Advisory →
  • Fix · GHSA-pgxq-p76c-x9cg verbb/formie (Packagist) Fixed in 2.2.21 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47266
  2. 2026-10-03 Alias added: GHSA-pgxq-p76c-x9cg

References

Advisory 1

Other 4

  • TI-2026-37985 Formie: Server-Side Template Injection in Formie Hidden field defaults CVSS 3.1CRITICAL 9.8
  • TI-2026-33438 Formie: Pre-authenticated server-side template injection in Hidden fields CVSS 3.1CRITICAL 9.8
  • TI-2026-53255 Formie: Unauthenticated users can overwrite incomplete submissions via submit action CVSS 3.1HIGH 8.2
  • TI-2020-10575 The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header. CVSS 3.1CRITICAL 9.1
  • TI-2020-10552 An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. CVSS 3.1HIGH 8.8
  • TI-2026-53254 Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials CVSS 3.1HIGH 8.5
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences