{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/formie--2.2.23/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:verbb:formie:*:*:*:*:*:craft_cms:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2026-76087"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Formie (3.0.0 - 3.1.30)","Formie (\u003c 2.2.23)","Formie (\u003c 3.1.31)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","ssrf","credential-theft"],"_cs_type":"advisory","_cs_vendors":["Verbb"],"content_html":"\u003cp\u003eThe Formie plugin for Craft CMS is susceptible to an unauthenticated submission hijacking vulnerability, tracked as CVE-2026-76087. The vulnerability exists within the \u003ccode\u003eformie/submissions/submit\u003c/code\u003e action, which fails to verify that the submission ID provided by the client belongs to the active user's session. Specifically, the \u003ccode\u003eSubmissionsController::actionSubmit\u003c/code\u003e method trusts the user-supplied \u003ccode\u003esubmissionId\u003c/code\u003e without enforcing ownership checks or validating an edit token for incomplete submissions.\u003c/p\u003e\n\u003cp\u003eThis flaw allows an unauthenticated attacker to enumerate sequential submission IDs and overwrite or hijack the data within another user's in-progress, incomplete submission. If an attacker successfully overwrites the submission data, the corrupted or malicious entries are persisted and eventually forwarded through the form's integrated notification systems when the victim completes the form. This issue represents an incomplete fix for a previously identified vulnerability (GHSA-pgxq-p76c-x9cg). Defenders should prioritize upgrading to the patched versions immediately as no reliable workarounds exist.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthorized parties to manipulate form data entered by legitimate users. If exploited, attackers can inject malicious content into submissions that are then processed by the target's backend integrations or notification systems. This impacts organizations using Formie for critical data collection, such as lead generation, registrations, or application forms. Because the data is forwarded to integrations upon completion, attackers can effectively facilitate exfiltration of sensitive information or manipulate business workflows.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to Formie 3.1.31 or later for Craft 5, or 2.2.23 or later for Craft 4, to apply the mandatory ownership and token validation checks.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous patterns of sequential POST requests to the \u003ccode\u003eformie/submissions/submit\u003c/code\u003e endpoint, particularly those originating from unauthorized sessions.\u003c/li\u003e\n\u003cli\u003eAudit form notification logs for submissions that contain suspicious, unexpected, or non-user-supplied data values.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-23T19:57:39Z","date_published":"2026-09-23T19:57:29Z","id":"https://feed.craftedsignal.io/briefs/2026-09-formie-submission-hijacking/","summary":"The Formie plugin for Craft CMS is vulnerable to an unauthenticated submission hijacking flaw (CVE-2026-76087) where attackers can overwrite other users' in-progress forms by supplying arbitrary submission IDs.","title":"Unauthenticated Submission Overwrite in Formie Plugin for Craft CMS","url":"https://feed.craftedsignal.io/briefs/2026-09-formie-submission-hijacking/"}],"language":"en","title":"CraftedSignal Threat Feed - Formie (\u003c 2.2.23)","version":"https://jsonfeed.org/version/1.1"}