Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a valid submissionEditToken. An unauthenticated attacker can enumerate sequential IDs and overwrite or hijack another user's in-progress multi-page or save-for-later submission, and the modified data can be persisted and forwarded through notifications or integrations when the submission is completed. This is an incomplete remediation of CVE-2026-47266 because that earlier change validated edit tokens for save-submission but did not protect submit. Completed submissions are excluded by the isIncomplete filter. This issue is fixed in versions 2.2.23 and 3.1.31.

Affected: Packagist: verbb/formie

### Impact

The anonymous front-end action `formie/submissions/submit` (`SubmissionsController::actionSubmit`) trusted a client-supplied `submissionId` when loading an incomplete submission, with no session binding, ownership check, or edit token validation.

An unauthenticated attacker could enumerate sequential submission IDs and overwrite or hijack another user's in-progress (multi-page / save-for-later) submission. Tampered data could be persisted and forwarded via notifications and integrations when the submission was completed.

Completed submissions were not affected (`isIncomplete=true` filter). This is an incomplete remediation of [GHSA-pgxq-p76c-x9cg](https://github.com/advisories?query=GHSA-pgxq-p76c-x9cg), which added edit-token validation to `save-submission` but not to `submit`.

### Patches

Fixed in **3.1.31** (Craft 5) and **2.2.23** (Craft 4).

When resuming an existing submission on a site request, the submission ID must match the session-bound submission (`Form::getCurrentSubmission()`) or a valid `submissionEditToken` when `editingSubmission` is set. Cross-form submission ID reuse is also rejected.

### Workarounds

No reliable workaround without upgrading. Disabling multi-page forms or save-for-later reduces exposure but does not remove the vulnerability.

- Reported by Jorge González (jorge@jmilla.es)