CVE-2026-76087

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a valid submissionEditToken. An unauthenticated attacker can enumerate sequential IDs and overwrite or hijack another user's in-progress multi-page or save-for-later submission, and the modified data can be persisted and forwarded through notifications or integrations when the submission is completed. This is an incomplete remediation of CVE-2026-47266 because that earlier change validated edit tokens for save-submission but did not protect submit. Completed submissions are excluded by the isIncomplete filter. This issue is fixed in versions 2.2.23 and 3.1.31.

• CWE-639
• CWE-862

• https://github.com/verbb/formie/commit/323c2fe647a76fbccadf749728ee4ad9420efee1
• https://github.com/verbb/formie/commit/78a298ac3baf85ac283988dfce9cd42c9b958f16
• https://github.com/verbb/formie/releases/tag/2.2.23
• https://github.com/verbb/formie/releases/tag/3.1.31
• https://github.com/verbb/formie/security/advisories/GHSA-584p-f93j-wpgc

Published

Sep 23, 2026

Last Modified

Sep 24, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-76072The Continue CLI applies an incomplete denylist as its only …7.4
• CVE-2026-76073Label Studio does not scope the annotation detail endpoint t…8.8
• CVE-2026-76074The AutomatorWP – Automator plugin for no-code automations, …4.3
• CVE-2026-7608A vulnerability was detected in TRENDnet TEW-821DAP up to 1.…8
• CVE-2026-76081ZITADEL is an open source identity management platform. Prio…5.5
• CVE-2026-76086Formie is a Craft CMS plugin for creating forms. Prior to 2.…8.5
• CVE-2026-76089Formie is a Craft CMS plugin for creating forms. Prior to 2.…7.7
• CVE-2026-7609A flaw has been found in TRENDnet TEW-821DAP up to 1.12B01. …8.8
• CVE-2026-76098Mistune is a Python Markdown parser with renderers and plugi…7.5
• CVE-2026-7610A vulnerability has been found in TRENDnet TEW-821DAP 1.12B0…8.1
• CVE-2026-76104Dell ObjectScale, versions prior to 4.4.0.0, contains an Inc…5.5
• CVE-2026-7611A vulnerability was found in TRENDnet TEW-821DAP up to 1.12B…8.1