formie's unauthenticated front-end submission editing can overwrite existing submissions

高 8.7CVE-2026-47266 · GHSA-pgxq-p76c-x9cg · 29/05/2026 公開 · 22/07/2026 更新

要点

CVE-2026-47266 は verbb/formie に影響する深刻度「高」 (CVSS 8.7) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.31%（全脆弱性の 24.1% より高い）。
対処：3.1.26, 2.2.21 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
verbb/formie Packagist	`≥ 3.0.0, < 3.1.26< 2.2.21`	`3.1.262.2.21`

概要

Impact

Unauthenticated users could modify existing submissions by posting a known or guessed submission ID to formie/submissions/save-submission.

Patches

2.2.21, 3.1.26

Workarounds

Block unauthenticated access to actions/formie/submissions/save-submission, or disable/customize front-end submission editing until patched.

Credit

formie extends many thanks to:

Florian (Cyber Security Engineer, arcade solutions ag)
Contact: [email protected]

NVD の説明

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.21 and 3.1.26, unauthenticated users could modify existing submissions by posting a known or guessed submission ID to formie/submissions/save-submission. This vulnerability is fixed in 2.2.21 and 3.1.26.