CVE-2026-76087 in Formie Plugin
Summary
by MITRE • 09/23/2026
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a valid submissionEditToken. An unauthenticated attacker can enumerate sequential IDs and overwrite or hijack another user's in-progress multi-page or save-for-later submission, and the modified data can be persisted and forwarded through notifications or integrations when the submission is completed. This is an incomplete remediation of CVE-2026-47266 because that earlier change validated edit tokens for save-submission but did not protect submit. Completed submissions are excluded by the isIncomplete filter. This issue is fixed in versions 2.2.23 and 3.1.31.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified involves a critical authentication bypass within Formie, a widely used plugin for Craft CMS designed to facilitate form creation and data collection. The core technical flaw resides in the SubmissionsController::actionSubmit method, specifically when handling anonymous submissions via the formie/submissions/submit action. In versions prior to 2.2.23 and 3.1.31, this endpoint accepts a client-supplied submissionId parameter without performing adequate validation checks. The system fails to bind the request to an active user session, lacks ownership verification mechanisms, and does not require a valid submissionEditToken for incomplete submissions. This architectural oversight allows any unauthenticated actor to interact directly with form data by manipulating the identifier passed in the HTTP request payload.
The operational impact of this flaw is severe due to its potential for both data integrity compromise and privacy violations. An attacker can exploit predictable or sequential nature of database identifiers to enumerate valid submission IDs. By targeting these IDs, an unauthenticated user can overwrite existing incomplete submissions belonging to legitimate users who are in the process of filling out multi-page forms or utilizing save-for-later functionality. This hijacking capability means that sensitive information entered by a victim can be replaced with malicious data before it is finalized and stored permanently. Furthermore, because Formie often integrates with external notification systems and third-party services, corrupted submission data may trigger automated workflows, sending false alerts to administrators or propagating manipulated content through connected integrations such as email marketing platforms or CRM systems.
This issue represents an incomplete remediation of a previously disclosed vulnerability, CVE-2026-47266. The earlier fix addressed the save-submission endpoint by enforcing edit token validation but neglected to apply similar protections to the final submit action for incomplete records. The developers relied on an isIncomplete filter which was insufficient because it did not account for unauthenticated access vectors that bypass session-based security models entirely. Consequently, while partial protection existed for certain stages of form completion, the critical point of submission remained exposed to unauthorized modification and hijacking attacks.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, as it allows an actor to access or modify resources without proper authorization checks. It also maps to MITRE ATT&CK technique T1078 Valid Accounts when considering the exploitation of existing user sessions indirectly through data manipulation, and potentially T1565 Data Manipulation if the attacker modifies stored data to cause downstream effects. The lack of input validation on critical identifiers is a classic example of CWE-20 Improper Input Validation leading to broader security failures.
To mitigate this risk, organizations must upgrade Formie to version 2.2.23 or later for Craft CMS 4.x environments, or version 3.1.31 and above for earlier versions. These updates implement robust validation logic that ensures submissionId parameters are verified against active sessions and require valid edit tokens even during the final submission phase of incomplete forms. Administrators should also audit their current deployment status to ensure no legacy instances remain unpatched, as these continue to be susceptible to enumeration-based attacks where sequential ID guessing can lead to significant data integrity issues across user-facing applications relying on Formie for critical data collection workflows.