Executive Summary

CVE-2026-47266 is a vulnerability in the Formie plugin for Craft CMS that allows unauthenticated users to modify existing form submissions. This happens because the plugin accepted submission editing requests without proper authentication, allowing attackers to post a known or guessed submission ID to the endpoint formie/submissions/save-submission and overwrite submissions.

The vulnerability affects versions prior to 2.2.21 and 3.1.26 and was fixed by adding a submissionEditToken to secure submission editing requests.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthorized users to alter form submissions without authentication. This could lead to data integrity issues, where submitted information is changed or corrupted.

Such unauthorized modifications could affect business processes relying on accurate form data, potentially causing operational disruptions or misleading data collection.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unauthorized POST requests to the endpoint formie/submissions/save-submission, especially those that include submission IDs that are known or guessed.

You can use network monitoring or web server logs to identify such suspicious requests.

• Use command-line tools like curl or wget to test if the endpoint accepts unauthenticated submission edits.
• Example curl command to test the vulnerability (replace URL and submission ID accordingly):

curl -X POST https://yourdomain.com/formie/submissions/save-submission -d 'submissionId=KNOWN_OR_GUESSED_ID&other_form_data=...' -v

• Check web server access logs for POST requests to formie/submissions/save-submission without authentication.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the Formie plugin to version 2.2.21 or 3.1.26 or later, where the vulnerability is fixed by adding a submissionEditToken to secure submission editing requests.

If updating immediately is not possible, temporarily block unauthenticated access to the endpoint formie/submissions/save-submission or disable front-end submission editing to prevent unauthorized modifications.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated users to modify existing form submissions by guessing or knowing submission IDs, which could lead to unauthorized data alteration.

Such unauthorized modification of data can impact compliance with data protection regulations like GDPR and HIPAA, which require ensuring the integrity and confidentiality of personal and sensitive information.

If exploited, this vulnerability could result in data integrity issues, unauthorized data changes, and potential breaches of privacy obligations mandated by these standards.

Applying the security patches in versions 2.2.21 and 3.1.26, which introduce a submissionEditToken to secure submission editing, helps mitigate these compliance risks.

Useful 0 Not Useful 0