Executive brief
Formie is a plugin for Craft CMS used to create and manage web forms. A security flaw allows unauthorized individuals to modify or overwrite existing form submissions by guessing or obtaining a submission ID. This could lead to the corruption of customer data or the unauthorized alteration of records submitted through the website.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The 'formie/submissions/save-submission' endpoint failed to properly validate the authorization of unauthenticated users attempting to edit existing records. By sending a POST request with a specific submission ID, an attacker can modify the data of that submission without any prior authentication or user interaction. The fix introduces a 'submissionEditToken' to ensure that only authorized requests can modify existing entries.
Affected products
- Verbb Formie < 2.2.21, >= 3.0.0, < 3.1.26
Timeline
- 2026-05-19: patched: Versions 2.2.21 and 3.1.26 released
- 2026-05-29: advisory: GitHub Advisory and NVD record published