CVE-2026-76087: Formie: Unauthenticated users can overwrite incomplete submissions via submit action
Impact
The anonymous front-end action formie/submissions/submit (SubmissionsController::actionSubmit) trusted a client-supplied submissionId when loading an incomplete submission, with no session binding, ownership check, or edit token validation.
An unauthenticated attacker could enumerate sequential submission IDs and overwrite or hijack another user's in-progress (multi-page / save-for-later) submission. Tampered data could be persisted and forwarded via notifications and integrations when the submission was completed.
Completed submissions were not affected (isIncomplete=true filter). This is an incomplete remediation of GHSA-pgxq-p76c-x9cg, which added edit-token validation to save-submission but not to submit.
Patches
Fixed in 3.1.31 (Craft 5) and 2.2.23 (Craft 4).
When resuming an existing submission on a site request, the submission ID must match the session-bound submission (Form::getCurrentSubmission()) or a valid submissionEditToken when editingSubmission is set. Cross-form submission ID reuse is also rejected.
Workarounds
No reliable workaround without upgrading. Disabling multi-page forms or save-for-later reduces exposure but does not remove the vulnerability.
- Reported by Jorge González (jorge@jmilla.es)
Other sources
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a valid submissionEditToken. An unauthenticated attacker can enumerate sequential IDs and overwrite or hijack another user's in-progress multi-page or save-for-later submission, and the modified data can be persisted and forwarded through notifications or integrations when the submission is completed. This is an incomplete remediation of CVE-2026-47266 because that earlier change validated edit tokens for save-submission but did not protect submit. Completed submissions are excluded by the isIncomplete filter. This issue is fixed in versions 2.2.23 and 3.1.31.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/verbb/formieto a version that resolves this vulnerability.Fixed in 2.2.23 - Upgrade
Upgrade
composer/verbb/formieto a version that resolves this vulnerability.Fixed in 3.1.31 - Upgrade
Upgrade
Formie for Craft CMS 5to a version that resolves this vulnerability.Fixed in 3.1.31 - Upgrade
Upgrade
Formie for Craft CMS 4to a version that resolves this vulnerability.Fixed in 2.2.23 - Configuration
Disable multi-page forms or save-for-later functionality to reduce exposure; this does not fully remove the vulnerability.
Formie multi-page forms and save-for-later = disabled
Event History
Frequently Asked Questions
Which submissions are at risk?
Only incomplete submissions are affected, including multi-page and save-for-later submissions. Completed submissions are not affected because the vulnerable lookup filters for incomplete submissions.
What does an attacker need to exploit this?
An attacker does not need authentication or user interaction. They can enumerate sequential submission IDs and submit a request containing another user's incomplete submission ID.
What could exploitation allow?
An attacker can overwrite or hijack another user's in-progress submission. The altered data can be persisted and, once the submission is completed, forwarded through notifications and integrations.
Which releases include the fix?
The issue is fixed in Formie 3.1.31 for Craft 5 and Formie 2.2.23 for Craft 4. The fix requires a resumed submission to match the session-bound submission or provide a valid edit token when editing, and rejects cross-form submission ID reuse.
Is there a reliable mitigation if upgrading is delayed?
No reliable workaround is provided without upgrading.