formie's unauthenticated front-end submission editing can overwrite existing submissions

ALTO 8.7CVE-2026-47266 · GHSA-pgxq-p76c-x9cg · Published 29/05/2026 · updated 22/07/2026

En resumen

CVE-2026-47266 es una vulnerabilidad ALTO (CVSS 8.7) que afecta a verbb/formie.
Probabilidad de explotación en los próximos 30 días (EPSS): 0.31%, mayor que el 24.1% de las vulnerabilidades.
Solución: actualizar a 3.1.26, 2.2.21 o posterior.

Package	Affected versions	Patched versions
verbb/formie Packagist	`≥ 3.0.0, < 3.1.26< 2.2.21`	`3.1.262.2.21`

Description

Impact

Unauthenticated users could modify existing submissions by posting a known or guessed submission ID to formie/submissions/save-submission.

Patches

2.2.21, 3.1.26

Workarounds

Block unauthenticated access to actions/formie/submissions/save-submission, or disable/customize front-end submission editing until patched.

Credit

formie extends many thanks to:

Florian (Cyber Security Engineer, arcade solutions ag)
Contact: [email protected]

NVD description

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.21 and 3.1.26, unauthenticated users could modify existing submissions by posting a known or guessed submission ID to formie/submissions/save-submission. This vulnerability is fixed in 2.2.21 and 3.1.26.