CVE-2026-76087 Details
Description
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a valid submissionEditToken. An unauthenticated attacker can enumerate sequential IDs and overwrite or hijack another user's in-progress multi-page or save-for-later submission, and the modified data can be persisted and forwarded through notifications or integrations when the submission is completed. This is an incomplete remediation of CVE-2026-47266 because that earlier change validated edit tokens for save-submission but did not protect submit. Completed submissions are excluded by the isIncomplete filter. This issue is fixed in versions 2.2.23 and 3.1.31.
A vulnerability in the Formie Craft CMS plugin allows unauthenticated users to overwrite or hijack incomplete submissions. This issue affects Formie versions prior to 2.2.23 and 3.1.31. The vulnerability arises because the 'submit' action in the SubmissionsController trusts client-supplied submission IDs without proper validation. As a result, an attacker can manipulate submission data, which may be persisted and sent through notifications or integrations when the submission is finalized. The vulnerability is particularly concerning for multi-page or 'save-for-later' submissions, as completed submissions are excluded from the issue.
Users can upgrade to Formie versions 2.2.23 or 3.1.31 to address this vulnerability. Instructions for downloading the latest version are available on the Formie GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 23, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/verbb/formie/commit/323c2fe647a76fbccadf749728ee4ad9420efee1 | [email protected] | Source CodeVendor |
| https://github.com/verbb/formie/commit/78a298ac3baf85ac283988dfce9cd42c9b958f16 | [email protected] | Source CodeVendor |
| https://github.com/verbb/formie/releases/tag/2.2.23 | [email protected] | Release NotesVendor |
| https://github.com/verbb/formie/releases/tag/3.1.31 | [email protected] | Release NotesVendor |
| https://github.com/verbb/formie/security/advisories/GHSA-584p-f93j-wpgc | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Verbb Formie | < 2.2.23 (semver) < 3.1.31 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 23, 2026 | New CVE Received | [email protected] |