En bref
- CVE-2026-47266 est une vulnérabilité ÉLEVÉE (CVSS 8.7) touchant verbb/formie.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.31%, plus élevée que 24.1% des vulnérabilités.
- Correctif : mettre à jour vers 3.1.26, 2.2.21 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| verbb/formie Packagist | ≥ 3.0.0, < 3.1.26< 2.2.21
| 3.1.262.2.21
|
Description
Impact
Unauthenticated users could modify existing submissions by posting a known or guessed submission ID to formie/submissions/save-submission.
Patches
2.2.21, 3.1.26
Workarounds
Block unauthenticated access to actions/formie/submissions/save-submission, or disable/customize front-end submission editing until patched.
Credit
formie extends many thanks to:
NVD description
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.21 and 3.1.26, unauthenticated users could modify existing submissions by posting a known or guessed submission ID to formie/submissions/save-submission. This vulnerability is fixed in 2.2.21 and 3.1.26.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free