---
id: CVE-2026-76087
title: Formie is a Craft CMS plugin for creating forms
summary: >-
  Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31,
  Formie's anonymous formie/submissions/submit action in
  SubmissionsController::actionSubmit trusts a client-supplied submissionId when
  loading an incomplete subm…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N'
cwe:
  - CWE-639
  - CWE-862
vendor: verbb
product: formie
affected:
  - formie < 2.2.23
  - 'formie >= 3.0.0, < 3.1.31'
patched:
  - verbb/formie 3.1.31
  - verbb/formie 2.2.23
published: '2026-09-23'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T14:18:16.887'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-76087'
references:
  - url: >-
      https://github.com/verbb/formie/commit/323c2fe647a76fbccadf749728ee4ad9420efee1
    label: security-advisories@github.com
  - url: >-
      https://github.com/verbb/formie/commit/78a298ac3baf85ac283988dfce9cd42c9b958f16
    label: security-advisories@github.com
  - url: 'https://github.com/verbb/formie/releases/tag/2.2.23'
    label: security-advisories@github.com
  - url: 'https://github.com/verbb/formie/releases/tag/3.1.31'
    label: security-advisories@github.com
  - url: 'https://github.com/verbb/formie/security/advisories/GHSA-584p-f93j-wpgc'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-584p-f93j-wpgc'
tags:
  - nvd
  - cve.org
  - ghsa
  - composer
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-24T14:12:07.675345Z'
aliases:
  - GHSA-584p-f93j-wpgc
ecosystem: composer
ingestedAt: '2026-09-23T19:31:04.465Z'
epss: 0.00313
epssPercentile: 0.21528
---

## Overview

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a valid submissionEditToken. An unauthenticated attacker can enumerate sequential IDs and overwrite or hijack another user's in-progress multi-page or save-for-later submission, and the modified data can be persisted and forwarded through notifications or integrations when the submission is completed. This is an incomplete remediation of CVE-2026-47266 because that earlier change validated edit tokens for save-submission but did not protect submit. Completed submissions are excluded by the isIncomplete filter. This issue is fixed in versions 2.2.23 and 3.1.31.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-76087)

Affected packages:

- `verbb/formie >= 3.0.0, < 3.1.31`
- `verbb/formie < 2.2.23`

Patched in:

- `verbb/formie 3.1.31`
- `verbb/formie 2.2.23`

Source: https://github.com/advisories/GHSA-584p-f93j-wpgc