Executive brief
Formie is a popular Craft CMS form builder plugin. An unauthenticated attacker can enumerate and hijack in-progress form submissions from other users by guessing sequential submission IDs, then modify or complete them with malicious data. This affects only incomplete multi-page or save-for-later submissions; completed submissions are protected by a safety filter.
Technical details
The vulnerability is an authorization bypass in the `formie/submissions/submit` action (SubmissionsController::actionSubmit) that fails to validate submission ownership when loading incomplete submissions. The vulnerable code trusts client-supplied submissionId parameters without session binding, ownership verification, or edit token validation. An unauthenticated attacker can enumerate sequential submission IDs and overwrite data in another user's in-progress submission; tampering persists when the victim completes the submission and triggers notifications or integrations. This is an incomplete fix of GHSA-pgxq-p76c-x9cg, which added edit-token validation to the `save-submission` action but missed the `submit` action. Patches are available in Formie 3.1.31 (Craft 5) and 2.2.23 (Craft 4).
Affected products
- Verbb Formie >=3.0.0, <3.1.31; <2.2.23
Timeline
- 2026-09-23: disclosed
- 2026-09-23: patched: Fixed in versions 3.1.31 (Craft 5) and 2.2.23 (Craft 4)