https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 15:41:36 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-76087 <p>Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie&#39;s anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a valid submissionEditToken. An unauthenticated attacker can enumerate sequential IDs and overwrite or hijack another user&#39;s in-progress multi-page or save-for-later submission, and the modified data can be persisted and forwarded through notifications or integrations when the submission is completed. This is an incomplete remediation of CVE-2026-47266 because that earlier change validated edit tokens for save-submission but did not protect submit. Completed submissions are excluded by the isIncomplete filter. This issue is fixed in versions 2.2.23 and 3.1.31.</p> <p>Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie&#39;s anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a valid submissionEditToken. An unauthenticated attacker can enumerate sequential IDs and overwrite or hijack another user&#39;s in-progress multi-page or save-for-later submission, and the modified data can be persisted and forwarded through notifications or integrations when the submission is completed. This is an incomplete remediation of CVE-2026-47266 because that earlier change validated edit tokens for save-submission but did not protect submit. Completed submissions are excluded by the isIncomplete filter. This issue is fixed in versions 2.2.23 and 3.1.31.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-76087 https://vulnerability.circl.lu/vuln/ghsa-584p-f93j-wpgc <p><strong>Affected:</strong> Packagist: verbb/formie</p> <p>### Impact</p> <p>The anonymous front-end action `formie/submissions/submit` (`SubmissionsController::actionSubmit`) trusted a client-supplied `submissionId` when loading an incomplete submission, with no session binding, ownership check, or edit token validation.</p> <p>An unauthenticated attacker could enumerate sequential submission IDs and overwrite or hijack another user&#39;s in-progress (multi-page / save-for-later) submission. Tampered data could be persisted and forwarded via notifications and integrations when the submission was completed.</p> <p>Completed submissions were not affected (`isIncomplete=true` filter). This is an incomplete remediation of [GHSA-pgxq-p76c-x9cg](https://github.com/advisories?query=GHSA-pgxq-p76c-x9cg), which added edit-token validation to `save-submission` but not to `submit`.</p> <p>### Patches</p> <p>Fixed in **3.1.31** (Craft 5) and **2.2.23** (Craft 4).</p> <p>When resuming an existing submission on a site request, the submission ID must match the session-bound submission (`Form::getCurrentSubmission()`) or a valid `submissionEditToken` when `editingSubmission` is set. Cross-form submission ID reuse is also rejected.</p> <p>### Workarounds</p> <p>No reliable workaround without upgrading. Disabling multi-page forms or save-for-later reduces exposure but does not remove the vulnerability.</p> <p>- Reported by Jorge González (jorge@jmilla.es)</p> <p><strong>Affected:</strong> Packagist: verbb/formie</p> <p>### Impact</p> <p>The anonymous front-end action `formie/submissions/submit` (`SubmissionsController::actionSubmit`) trusted a client-supplied `submissionId` when loading an incomplete submission, with no session binding, ownership check, or edit token validation.</p> <p>An unauthenticated attacker could enumerate sequential submission IDs and overwrite or hijack another user&#39;s in-progress (multi-page / save-for-later) submission. Tampered data could be persisted and forwarded via notifications and integrations when the submission was completed.</p> <p>Completed submissions were not affected (`isIncomplete=true` filter). This is an incomplete remediation of [GHSA-pgxq-p76c-x9cg](https://github.com/advisories?query=GHSA-pgxq-p76c-x9cg), which added edit-token validation to `save-submission` but not to `submit`.</p> <p>### Patches</p> <p>Fixed in **3.1.31** (Craft 5) and **2.2.23** (Craft 4).</p> <p>When resuming an existing submission on a site request, the submission ID must match the session-bound submission (`Form::getCurrentSubmission()`) or a valid `submissionEditToken` when `editingSubmission` is set. Cross-form submission ID reuse is also rejected.</p> <p>### Workarounds</p> <p>No reliable workaround without upgrading. Disabling multi-page forms or save-for-later reduces exposure but does not remove the vulnerability.</p> <p>- Reported by Jorge González (jorge@jmilla.es)</p> https://vulnerability.circl.lu/vuln/ghsa-584p-f93j-wpgc