Formie: Unauthenticated users can overwrite incomplete submissions via submit action
Impact
The anonymous front-end action formie/submissions/submit (SubmissionsController::actionSubmit) trusted a client-supplied submissionId when loading an incomplete submission, with no session binding, ownership check, or edit token validation.
An unauthenticated attacker could enumerate sequential submission IDs and overwrite or hijack another user's in-progress (multi-page / save-for-later) submission. Tampered data could be persisted and forwarded via notifications and integrations when the submission was completed.
Completed submissions were not affected (isIncomplete=true filter). This is an incomplete remediation of GHSA-pgxq-p76c-x9cg, which added edit-token validation to save-submission but not to submit.
Patches
Fixed in 3.1.31 (Craft 5) and 2.2.23 (Craft 4).
When resuming an existing submission on a site request, the submission ID must match the session-bound submission (Form::getCurrentSubmission()) or a valid submissionEditToken when editingSubmission is set. Cross-form submission ID reuse is also rejected.
Workarounds
No reliable workaround without upgrading. Disabling multi-page forms or save-for-later reduces exposure but does not remove the vulnerability.
- Reported by Jorge González (jorge@jmilla.es)
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de Composer | verbb/formie | >= 3.0.0, < 3.1.31, < 2.2.23 | 3.1.31, 2.2.23 |
Referencias
- https://github.com/verbb/formie/security/advisories/GHSA-584p-f93j-wpgc
- https://github.com/verbb/formie/commit/323c2fe647a76fbccadf749728ee4ad9420efee1
- https://github.com/verbb/formie/commit/78a298ac3baf85ac283988dfce9cd42c9b958f16
- https://github.com/verbb/formie
- https://github.com/verbb/formie/releases/tag/2.2.23
- https://github.com/verbb/formie/releases/tag/3.1.31
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N- Debilidad (CWE)
CWE-639, CWE-862- Plataforma
- Composer
- Paquete
verbb/formie- Publicada
- 23.09.2026
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-584p-f93j-wpgc - CC BY 4.0
Historial de vulnerabilidades: verbb/formie
Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 10
- Primera → última
- 05.2024 09.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 2
- Alta 4
- Media 4
Divulgaciones por año
- 2024: 1
- 2025: 2
- 2026: 7
-
Formie: Unauthenticated users can overwrite incomplete submissions via submit action esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.