CVE-2026-76087

Name of the Vulnerable Software and Affected Versions Formie versions prior to 2.2.23 Formie versions prior to 3.1.31

Description The anonymous endpoint 'formie/submissions/submit' in the SubmissionsController::actionSubmit function trusts a client-supplied submissionId when loading incomplete submissions. This occurs without session binding, ownership validation, or a valid submissionEditToken. An unauthenticated attacker can enumerate sequential IDs to overwrite or hijack another user's in-progress multi-page or save-for-later submission. The modified data can then be persisted and forwarded through notifications or integrations once the submission is completed. Completed submissions are not affected.

Recommendations Update to version 2.2.23. Update to version 3.1.31. As a temporary mitigation, disable multi-page forms or the save-for-later feature to reduce exposure.