{"id":"CVE-2026-76087","aliases":["GHSA-584p-f93j-wpgc"],"url":"https://o3.security/vulnerability/CVE-2026-76087","summary":"Formie: Unauthenticated users can overwrite incomplete submissions via submit action","details":"### Impact\n\nThe anonymous front-end action `formie/submissions/submit` (`SubmissionsController::actionSubmit`) trusted a client-supplied `submissionId` when loading an incomplete submission, with no session binding, ownership check, or edit token validation.\n\nAn unauthenticated attacker could enumerate sequential submission IDs and overwrite or hijack another user's in-progress (multi-page / save-for-later) submission. Tampered data could be persisted and forwarded via notifications and integrations when the submission was completed.\n\nCompleted submissions were not affected (`isIncomplete=true` filter). This is an incomplete remediation of [GHSA-pgxq-p76c-x9cg](https://github.com/advisories?query=GHSA-pgxq-p76c-x9cg), which added edit-token validation to `save-submission` but not to `submit`.\n\n### Patches\n\nFixed in **3.1.31** (Craft 5) and **2.2.23** (Craft 4).\n\nWhen resuming an existing submission on a site request, the submission ID must match the session-bound submission (`Form::getCurrentSubmission()`) or a valid `submissionEditToken` when `editingSubmission` is set. Cross-form submission ID reuse is also rejected.\n\n### Workarounds\n\nNo reliable workaround without upgrading. Disabling multi-page forms or save-for-later reduces exposure but does not remove the vulnerability.\n\n- Reported by Jorge González (jorge@jmilla.es)","published":"2026-09-23T18:35:45.304Z","modified":"2026-10-21T02:59:31.376002595Z","cvss":{"score":8.2,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"verbb/formie","fixedVersion":"3.1.31"},{"ecosystem":"Packagist","name":"verbb/formie","fixedVersion":"2.2.23"}],"fix":{"url":"https://github.com/verbb/formie/commit/323c2fe647a76fbccadf749728ee4ad9420efee1","label":"verbb/formie@323c2fe"},"references":[{"type":"WEB","url":"https://github.com/verbb/formie/releases/tag/2.2.23"},{"type":"WEB","url":"https://github.com/verbb/formie/releases/tag/3.1.31"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76087.json"},{"type":"ADVISORY","url":"https://github.com/verbb/formie/security/advisories/GHSA-584p-f93j-wpgc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76087"},{"type":"FIX","url":"https://github.com/verbb/formie/commit/323c2fe647a76fbccadf749728ee4ad9420efee1"},{"type":"FIX","url":"https://github.com/verbb/formie/commit/78a298ac3baf85ac283988dfce9cd42c9b958f16"},{"type":"PACKAGE","url":"https://github.com/verbb/formie"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:59:31.376002595Z"}}