CVE-2026-76087
Received Received - Intake

Formie Plugin Submission ID Hijacking Vulnerability

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a valid submissionEditToken. An unauthenticated attacker can enumerate sequential IDs and overwrite or hijack another user's in-progress multi-page or save-for-later submission, and the modified data can be persisted and forwarded through notifications or integrations when the submission is completed. This is an incomplete remediation of CVE-2026-47266 because that earlier change validated edit tokens for save-submission but did not protect submit. Completed submissions are excluded by the isIncomplete filter. This issue is fixed in versions 2.2.23 and 3.1.31.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-76087
EUVD
EUVD-2026-85547

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
formie formie to 2.2.23 (inc)
formie formie to 3.1.31 (inc)
verbb formie 2.2.23
verbb formie to 3.1.31 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Formie plugin for Craft CMS allows unauthenticated users to overwrite incomplete form submissions by exploiting the formie/submissions/submit action. The issue occurs because the action accepts a client-supplied submissionId without verifying session ownership, edit tokens, or proper authorization. Attackers can guess sequential submission IDs to hijack or modify another user's in-progress multi-page or saved submissions.

Detection Guidance

To detect this vulnerability, monitor for unusual submission activity in Formie logs, particularly for sequential submission ID enumeration attempts or unauthorized modifications to in-progress submissions. Check for requests to the formie/submissions/submit endpoint with manipulated submissionId parameters.

Impact Analysis

An attacker could modify your in-progress form submissions, potentially altering data before you complete and submit them. This could lead to incorrect information being processed, notifications being sent to unintended recipients, or integrations receiving tampered data. Completed submissions are not affected.

Compliance Impact

This vulnerability could lead to unauthorized data modification, potentially violating integrity requirements under GDPR and HIPAA. If personal or sensitive data is altered without consent, it may result in non-compliance with data integrity and protection principles.

Mitigation Strategies

Immediately upgrade Formie to versions 2.2.23 or 3.1.31 or later. No reliable workaround exists other than upgrading. Ensure all installations are updated to prevent exploitation of this authorization bypass vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76087. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart