The Formie plugin for Craft CMS is vulnerable to an unauthenticated submission hijacking flaw (CVE-2026-76087) where attackers can overwrite other users' in-progress forms by supplying arbitrary submission IDs.
Formie +4
web-vulnerability
ssrf
credential-theft
web-application
cms
vulnerability
access-control
4t
1c
updated