formie's unauthenticated front-end submission editing can overwrite existing submissions

HIGH 8.7CVE-2026-47266 · GHSA-pgxq-p76c-x9cg · Published 29/05/2026 · updated 22/07/2026

In short

CVE-2026-47266 is a HIGH (CVSS 8.7) vulnerability affecting verbb/formie.
Chance of exploitation in the next 30 days (EPSS): 0.31%, higher than 24.1% of all vulnerabilities.
Fix: update to 3.1.26, 2.2.21 or later.

Package	Affected versions	Patched versions
verbb/formie Packagist	`≥ 3.0.0, < 3.1.26< 2.2.21`	`3.1.262.2.21`

Description

Impact

Unauthenticated users could modify existing submissions by posting a known or guessed submission ID to formie/submissions/save-submission.

Patches

2.2.21, 3.1.26

Workarounds

Block unauthenticated access to actions/formie/submissions/save-submission, or disable/customize front-end submission editing until patched.

Credit

formie extends many thanks to:

Florian (Cyber Security Engineer, arcade solutions ag)
Contact: [email protected]

NVD description

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.21 and 3.1.26, unauthenticated users could modify existing submissions by posting a known or guessed submission ID to formie/submissions/save-submission. This vulnerability is fixed in 2.2.21 and 3.1.26.