{"id":"CVE-2026-47266","aliases":["GHSA-pgxq-p76c-x9cg"],"url":"https://o3.security/vulnerability/CVE-2026-47266","summary":"Formie: Unauthenticated front-end submission editing can overwrite existing submissions","details":"Formie is a Craft CMS plugin for creating forms. Prior to 2.2.21 and 3.1.26, unauthenticated users could modify existing submissions by posting a known or guessed submission ID to formie/submissions/save-submission. This vulnerability is fixed in 2.2.21 and 3.1.26.","published":"2026-05-29T19:03:43.175Z","modified":"2026-08-12T03:51:30.729979702Z","cvss":null,"epss":{"score":0.00311,"percentile":0.23984,"asOf":"2026-08-20"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"verbb/formie","fixedVersion":"3.1.26"},{"ecosystem":"Packagist","name":"verbb/formie","fixedVersion":"2.2.21"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/verbb/formie/releases/tag/2.2.21"},{"type":"WEB","url":"https://github.com/verbb/formie/releases/tag/3.1.26"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47266.json"},{"type":"ADVISORY","url":"https://github.com/verbb/formie/security/advisories/GHSA-pgxq-p76c-x9cg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47266"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:30.729979702Z"}}