CVE-2026-76087
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In the Formie plugin for Craft CMS prior to 2.2.23 and 3.1.31, the anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a valid submissionEditToken. An unauthenticated attacker can enumerate sequential IDs and overwrite or hijack another user's in-progress multi-page or save-for-later submission, and the modified data can be persisted and forwarded through notifications or integrations when the submission is completed.
Risk Assessment
An unauthenticated attacker can hijack or overwrite other users' submissions, injecting false data that may be persisted and forwarded. This constitutes a data integrity breach and may lead to further attacks.
Recommendation
Upgrade the Formie plugin to version 2.2.23 or 3.1.31 (or later), which provides full edit token validation for the submit action.
Other vulnerabilities in Formie
See all- CVE-2026-52889Critical
Formie, a Craft CMS plugin for creating forms, before version 3.1.27 passes request-derived Hidden field defaults (e.g., User Agent, URL, query parameters) to Craft's Twig rendering layer. An unauthenticated attacker can place Twig syntax in these values, leading to server-side template evaluation (SSTI), potentially resulting in information disclosure, application state modification, or remote code execution.
- CVE-2026-45697Critical
Formie, a Craft CMS plugin, prior to versions 2.2.20 and 3.1.24 allows unauthenticated users to submit crafted values into Hidden fields that are evaluated as Twig during submission handling. This can lead to serious compromise of the Craft site.
- CVE-2026-76089High
In the Formie plugin for Craft CMS prior to 2.2.23 and 3.1.31, the formie/sent-notifications/get-resend-modal-content action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level authorization checks. Any authenticated user able to invoke the action can enumerate notification IDs and read recipient headers and complete HTML email bodies containing submitted form data, even without the sent-notification viewing permission.
- CVE-2026-76086High
In the Formie plugin for Craft CMS prior to 2.2.23 and 3.1.31, the formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a configured integration. An authenticated attacker can replace outbound host properties such as apiUrl while the server uses stored API keys or OAuth tokens, causing non-blind server-side requests to an attacker-controlled or internal host and returning the remote response.
- CVE-2026-47266High
The Formie plugin for Craft CMS before versions 2.2.21 and 3.1.26 allowed unauthenticated users to modify existing submissions by posting a known or guessed submission ID to the formie/submissions/save-submission endpoint.
Original NVD description (English source)
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a valid submissionEditToken. An unauthenticated attacker can enumerate sequential IDs and overwrite or hijack another user's in-progress multi-page or save-for-later submission, and the modified data can be persisted and forwarded through notifications or integrations when the submission is completed. This is an incomplete remediation of CVE-2026-47266 because that earlier change validated edit tokens for save-submission but did not protect submit. Completed submissions are excluded by the isIncomplete filter. This issue is fixed in versions 2.2.23 and 3.1.31.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS