# CVE-2026-76087: Verbb Formie unauthenticated submission hijacking via submit action

Source: https://junglewise.ai/threats/cve-2026-76087-verbb-formie-unauthenticated-submission-hijacking-via-submit  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76087 · Severity: high · CVSS 8.2 · Published 2026-09-23

Formie is a popular Craft CMS form builder plugin. An unauthenticated attacker can enumerate and hijack in-progress form submissions from other users by guessing sequential submission IDs, then modify or complete them with malicious data. This affects only incomplete multi-page or save-for-later submissions; completed submissions are protected by a safety filter.

Technologies: [verbb/formie (Packagist)](https://junglewise.ai/threats/technologies/verbb-formie), [Verbb Formie](https://junglewise.ai/threats/technologies/formie). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Verbb](https://junglewise.ai/threats/vendors/verbb).

## Quick answers

**Is CVE-2026-76087 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76087 being exploited in the wild.

**How severe is CVE-2026-76087?** High severity, with a CVSS score of 8.2, published 23 September 2026.

**Which products and versions are affected?** verbb/formie (Packagist) ECOSYSTEM:introduced=3.0.0,fixed=3.1.31; Verbb Formie >=3.0.0, <3.1.31; <2.2.23.

**Is there a fix for CVE-2026-76087?** Yes. verbb/formie (Packagist): upgrade to 3.1.31 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76087 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-76087?** Check whether you run verbb/formie (Packagist) or Verbb Formie at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- verbb/formie (Packagist): upgrade to 3.1.31 or later

  ```sh
  composer require verbb/formie:^3.1.31
  ```


## Technical details

The vulnerability is an authorization bypass in the `formie/submissions/submit` action (SubmissionsController::actionSubmit) that fails to validate submission ownership when loading incomplete submissions. The vulnerable code trusts client-supplied submissionId parameters without session binding, ownership verification, or edit token validation. An unauthenticated attacker can enumerate sequential submission IDs and overwrite data in another user's in-progress submission; tampering persists when the victim completes the submission and triggers notifications or integrations. This is an incomplete fix of GHSA-pgxq-p76c-x9cg, which added edit-token validation to the `save-submission` action but missed the `submit` action. Patches are available in Formie 3.1.31 (Craft 5) and 2.2.23 (Craft 4).

## Affected products

- Verbb Formie >=3.0.0, <3.1.31; <2.2.23

## Identifiers

- CVE-2026-76087
- GHSA-584p-f93j-wpgc

## Timeline

- 2026-09-23: disclosed
- 2026-09-23: patched: Fixed in versions 3.1.31 (Craft 5) and 2.2.23 (Craft 4)

## References

- [https://api.github.com/users/Pig-Tail](https://api.github.com/users/Pig-Tail)

## Related threats

- [Verbb Formie missing authorization on sent notification resend modal](https://junglewise.ai/threats/cve-2026-76089-verbb-formie-missing-authorization-on-sent-notification-resend)
- [Craft Formie integration form-settings SSRF and credential exfiltration](https://junglewise.ai/threats/cve-2026-76086-craft-formie-integration-form-settings-ssrf-and-credential)
- [Verbb Formie missing authorization in administrative settings](https://junglewise.ai/threats/verbb-formie-missing-authorization-in-administrative-settings-0ab8bf10)
- [Verbb Formie server-side template injection in Hidden fields](https://junglewise.ai/threats/cve-2026-52889-verbb-formie-server-side-template-injection-in-hidden-fields)
- [Verbb Formie authorization bypass in form submissions](https://junglewise.ai/threats/cve-2026-47266-verbb-formie-authorization-bypass-in-form-submissions)