CVE-2026-47266

Vulnerability

The Formie plugin for Craft CMS prior to versions 2.2.21 and 3.1.26 contains an authentication bypass vulnerability in the formie/submissions/save-submission endpoint. Unauthenticated users can modify existing submissions by posting a known or guessed submission ID to this endpoint. The vulnerability affects all versions before the patched releases. [1][2][3]

Exploitation

An attacker requires no authentication or user interaction. They can send a POST request to formie/submissions/save-submission with a valid submission ID (obtained through guessing, enumeration, or other means) and arbitrary field data. The attacker can iterate through sequential IDs to find valid submissions. [3]

Impact

Successful exploitation allows an unauthenticated attacker to overwrite any existing submission's data. This compromises data integrity, potentially leading to data corruption, injection of malicious content, or unauthorized modification of form responses. The attacker gains the ability to alter submissions without any privileges. [3]

Mitigation

The vulnerability is fixed in versions 2.2.21 and 3.1.26, released on 2026-05-29. Users should upgrade immediately. As a workaround, block unauthenticated access to the endpoint actions/formie/submissions/save-submission or disable front-end submission editing until patched. [1][2][3]