Skip to content
Threat Feed
Subscribe

Vendor

Verbb

4 briefs RSS
high advisory

Unauthenticated Submission Overwrite in Formie Plugin for Craft CMS

The Formie plugin for Craft CMS is vulnerable to an unauthenticated submission hijacking flaw (CVE-2026-76087) where attackers can overwrite other users' in-progress forms by supplying arbitrary submission IDs.

Formie +4 web-vulnerability ssrf credential-theft web-application cms vulnerability access-control
4t 1c updated
critical advisory

Formie Hidden Field SSTI Vulnerability (CVE-2026-52889)

Formie Hidden fields in versions prior to 3.1.27 are vulnerable to Server-Side Template Injection (SSTI), allowing an unauthenticated attacker to inject Twig syntax into request-derived default values, potentially leading to remote code execution, sensitive information disclosure, or application state modification.

Formie server-side-template-injection web-vulnerability craft-cms rce cve-2026-52889 network
1r 2t
high advisory

Formie Unauthenticated Submission Editing Vulnerability (CVE-2026-47266)

An unauthenticated user can modify existing Formie submissions by posting a known or guessed submission ID to `formie/submissions/save-submission`, affecting versions prior to 2.2.21 and versions 3.0.0 to 3.1.26.

Formie +1 unauthenticated-access data-manipulation cve cloud
1r 1c 1i
critical advisory

Formie Plugin Server-Side Template Injection via Hidden Fields (CVE-2026-45697)

A pre-authenticated server-side template injection vulnerability (CVE-2026-45697) exists in the Hidden fields of the Formie Craft plugin, allowing unauthenticated users to submit crafted values that are evaluated as Twig during submission handling, potentially leading to site compromise.

Formie server-side template injection code-execution craftcms
2r 1t