This flaw allows an unauthenticated attacker to enumerate sequential submission IDs and overwrite or hijack the data within another user's in-progress, incomplete submission. If an attacker successfully overwrites the submission data, the corrupted or malicious entries are persisted and eventually forwarded through the form's integrated notification systems when the victim completes the form. This issue represents an incomplete fix for a previously identified vulnerability (GHSA-pgxq-p76c-x9cg). Defenders should prioritize upgrading to the patched versions immediately as no reliable workarounds exist.

Impact

The vulnerability allows unauthorized parties to manipulate form data entered by legitimate users. If exploited, attackers can inject malicious content into submissions that are then processed by the target's backend integrations or notification systems. This impacts organizations using Formie for critical data collection, such as lead generation, registrations, or application forms. Because the data is forwarded to integrations upon completion, attackers can effectively facilitate exfiltration of sensitive information or manipulate business workflows.

Recommendation

• Upgrade to Formie 3.1.31 or later for Craft 5, or 2.2.23 or later for Craft 4, to apply the mandatory ownership and token validation checks.
• Review web server access logs for anomalous patterns of sequential POST requests to the formie/submissions/submit endpoint, particularly those originating from unauthorized sessions.
• Audit form notification logs for submissions that contain suspicious, unexpected, or non-user-supplied data values.