CVE-2026-76087: Verbb Formie unauthenticated submission hijacking via submit action

CVE-2026-76087 · Severity: high · CVSS 8.2 · Published 2026-09-23

Formie is a popular Craft CMS form builder plugin. An unauthenticated attacker can enumerate and hijack in-progress form submissions from other users by guessing sequential submission IDs, then modify or complete them with malicious data. This affects only incomplete multi-page or save-for-later submissions; completed submissions are protected by a safety filter.

Technologies: verbb/formie (Packagist), Verbb Formie. Vendors: Packagist, Verbb.

Quick answers

Is CVE-2026-76087 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-76087 being exploited in the wild.
How severe is CVE-2026-76087?
High severity, with a CVSS score of 8.2, published 23 September 2026.
Which products and versions are affected?
verbb/formie (Packagist) ECOSYSTEM:introduced=3.0.0,fixed=3.1.31; Verbb Formie >=3.0.0, <3.1.31; <2.2.23.
Is there a fix for CVE-2026-76087?
Yes. verbb/formie (Packagist): upgrade to 3.1.31 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76087 attacked?
It is attacked over the network.
Am I affected by CVE-2026-76087?
Check whether you run verbb/formie (Packagist) or Verbb Formie at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • verbb/formie (Packagist): upgrade to 3.1.31 or later
    composer require verbb/formie:^3.1.31

Technical details

The vulnerability is an authorization bypass in the `formie/submissions/submit` action (SubmissionsController::actionSubmit) that fails to validate submission ownership when loading incomplete submissions. The vulnerable code trusts client-supplied submissionId parameters without session binding, ownership verification, or edit token validation. An unauthenticated attacker can enumerate sequential submission IDs and overwrite data in another user's in-progress submission; tampering persists when the victim completes the submission and triggers notifications or integrations. This is an incomplete fix of GHSA-pgxq-p76c-x9cg, which added edit-token validation to the `save-submission` action but missed the `submit` action. Patches are available in Formie 3.1.31 (Craft 5) and 2.2.23 (Craft 4).

Affected products

  • Verbb Formie >=3.0.0, <3.1.31; <2.2.23

Identifiers

  • CVE-2026-76087
  • GHSA-584p-f93j-wpgc

Timeline

  • 2026-09-23: disclosed
  • 2026-09-23: patched: Fixed in versions 3.1.31 (Craft 5) and 2.2.23 (Craft 4)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.