Formie: Unauthenticated users can overwrite incomplete submissions via submit action
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.
Summary
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a valid submissionEditToken. An unauthenticated attacker can enumerate sequential IDs and overwrite or hijack another user's in-progress multi-page or save-for-later submission, and the modified data can be persisted and forwarded through notifications or integrations when the submission is completed. This is an incomplete remediation of CVE-2026-47266 because that earlier change validated edit tokens for save-submission but did not protect submit. Completed submissions are excluded by the isIncomplete filter. This issue is fixed in versions 2.2.23 and 3.1.31.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| verbb | formie | before 2.2.23; 3.0.0 to before 3.1.31 | 2.2.23, 3.1.31 | Patch available | CNA |
| — | verbb/formie (Packagist) | 3.0.0 to before 3.1.31 | 3.1.31 | Patch available | GHSA-584p-f93j-wpgc |
| — | verbb/formie (Packagist) | before 2.2.23 | 2.2.23 | Patch available | GHSA-584p-f93j-wpgc |
- formie Vendorverbb Affected before 2.2.23; 3.0.0 to before 3.1.31 Fixed in 2.2.23, 3.1.31 Patch available CNA
- verbb/formie (Packagist) Vendor— Affected 3.0.0 to before 3.1.31 Fixed in 3.1.31 Patch available GHSA-584p-f93j-wpgc
- verbb/formie (Packagist) Vendor— Affected before 2.2.23 Fixed in 2.2.23 Patch available GHSA-584p-f93j-wpgc
Remediation
- Fix · CNA formie (verbb) Fixed in 2.2.23, 3.1.31
- Fix · GHSA-584p-f93j-wpgc verbb/formie (Packagist) Fixed in 3.1.31 Advisory →
- Fix · GHSA-584p-f93j-wpgc verbb/formie (Packagist) Fixed in 2.2.23 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-76087
- 2026-10-03 Alias added: GHSA-584p-f93j-wpgc
References
Other 6
- https://github.com/verbb/formie/security/advisories/GHSA-584p-f93j-wpgc
- https://github.com/verbb/formie/commit/323c2fe647a76fbccadf749728ee4ad9420efee1
- https://github.com/verbb/formie/commit/78a298ac3baf85ac283988dfce9cd42c9b958f16
- https://github.com/verbb/formie/releases/tag/2.2.23
- https://github.com/verbb/formie/releases/tag/3.1.31
- https://github.com/verbb/formie
More verbb vulnerabilities
- TI-2026-37985 Formie: Server-Side Template Injection in Formie Hidden field defaults CVSS 3.1CRITICAL 9.8
- TI-2026-33438 Formie: Pre-authenticated server-side template injection in Hidden fields CVSS 3.1CRITICAL 9.8
- TI-2026-34846 Formie: Unauthenticated front-end submission editing can overwrite existing submissions CVSS 4.0HIGH 8.7
- TI-2020-10575 The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header. CVSS 3.1CRITICAL 9.1
- TI-2020-10552 An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. CVSS 3.1HIGH 8.8
- TI-2026-53254 Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials CVSS 3.1HIGH 8.5
Sources
- CVE-2026-76087 · CVE Program
- CVE-2026-76087 · NVD
- FIRST EPSS
- GHSA-584p-f93j-wpgc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences