Unauthenticated Submission Overwrite in Formie Plugin for Craft CMS

The Formie plugin for Craft CMS is susceptible to an unauthenticated submission hijacking vulnerability, tracked as CVE-2026-76087. The vulnerability exists within the formie/submissions/submit action, which fails to verify that the submission ID provided by the client belongs to the active user's session. Specifically, the SubmissionsController::actionSubmit method trusts the user-supplied submissionId without enforcing ownership checks or validating an edit token for incomplete submissions.

This flaw allows an unauthenticated attacker to enumerate sequential submission IDs and overwrite or hijack the data within another user's in-progress, incomplete submission. If an attacker successfully overwrites the submission data, the corrupted or malicious entries are persisted and eventually forwarded through the form's integrated notification systems when the victim completes the form. This issue represents an incomplete fix for a previously identified vulnerability (GHSA-pgxq-p76c-x9cg). Defenders should prioritize upgrading to the patched versions immediately as no reliable workarounds exist.

Impact

The vulnerability allows unauthorized parties to manipulate form data entered by legitimate users. If exploited, attackers can inject malicious content into submissions that are then processed by the target's backend integrations or notification systems. This impacts organizations using Formie for critical data collection, such as lead generation, registrations, or application forms. Because the data is forwarded to integrations upon completion, attackers can effectively facilitate exfiltration of sensitive information or manipulate business workflows.

Recommendation

• Upgrade to Formie 3.1.31 or later for Craft 5, or 2.2.23 or later for Craft 4, to apply the mandatory ownership and token validation checks.
• Review web server access logs for anomalous patterns of sequential POST requests to the formie/submissions/submit endpoint, particularly those originating from unauthorized sessions.
• Audit form notification logs for submissions that contain suspicious, unexpected, or non-user-supplied data values.