https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T15:32:25.157335+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-323041 EUVD-2026-323041 2026-10-06T15:32:25.159598+00:00 EUVD-2026-323041 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47266 fkie_cve-2026-47266 2026-10-06T15:32:25.159629+00:00

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.21 and 3.1.26, unauthenticated users could modify existing submissions by posting a known or guessed submission ID to formie/submissions/save-submission. This vulnerability is fixed in 2.2.21 and 3.1.26.

 https://cve.radiocsirt.org/vuln/ghsa-pgxq-p76c-x9cg GHSA-pgxq-p76c-x9cg — formie's unauthenticated front-end submission editing can overwrite existing submissions 2026-10-06T15:32:25.159666+00:00

Affected: Packagist: verbb/formie

### Impact Unauthenticated users could modify existing submissions by posting a known or guessed submission ID to `formie/submissions/save-submission`.

### Patches [2.2.21](https://github.com/verbb/formie/releases/tag/2.2.21), [3.1.26](https://github.com/verbb/formie/releases/tag/3.1.26)

### Workarounds Block unauthenticated access to `actions/formie/submissions/save-submission`, or disable/customize front-end submission editing until patched.

### Credit formie extends many thanks to: - Florian (Cyber Security Engineer, arcade solutions ag) - Contact: [security@arcade.ch](mailto:security@arcade.ch)