- Package
- verbb/formie
- Fixed in
- 3.1.31, 2.2.23
- Published
- Wed 23 Sep 2026, 19:36 LisbonUpdated Mon 26 Oct 2026, 01:25 Lisbon
- Installs on Packagist
- 427K
In plain words
An unauthenticated attacker could overwrite or take over another user's incomplete Formie submission because the submit action did not check that the submission belonged to them. This affects in-progress multi-page or save-for-later submissions, not completed submissions. Altered data could be saved and passed to notifications and integrations when the submission was completed.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| verbb/formie | >= 3.0.0, < 3.1.31 | 3.1.31 |
| verbb/formie | < 2.2.23 | 2.2.23 |
Am I affected?
Check composer.lock for verbb/formie: affected versions are below 2.2.23, or from 3.0.0 up to but not including 3.1.31. Check whether your forms use multi-page or save-for-later features and have incomplete submissions. Disabling those features does not rule out the vulnerability. Fixed versions are 2.2.23 for Craft 4 and 3.1.31 for Craft 5.
What to do
Check which version you have, then update to a fixed release for your branch (3.1.31, 2.2.23):
composer show verbb/formie | grep versions
composer update verbb/formieIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
There is no reliable workaround without upgrading. Disabling multi-page forms or save-for-later reduces exposure but does not remove the vulnerability.
The advisory's description
Impact
The anonymous front-end action formie/submissions/submit (SubmissionsController::actionSubmit) trusted a client-supplied submissionId when loading an incomplete submission, with no session binding, ownership check, or edit token validation.
An unauthenticated attacker could enumerate sequential submission IDs and overwrite or hijack another user's in-progress (multi-page / save-for-later) submission. Tampered data could be persisted and forwarded via notifications and integrations when the submission was completed.
Completed submissions were not affected (isIncomplete=true filter). This is an incomplete remediation of GHSA-pgxq-p76c-x9cg, which added edit-token validation to save-submission but not to submit.
Patches
Fixed in 3.1.31 (Craft 5) and 2.2.23 (Craft 4).
When resuming an existing submission on a site request, the submission ID must match the session-bound submission (Form::getCurrentSubmission()) or a valid submissionEditToken when editingSubmission is set. Cross-form submission ID reuse is also rejected.
Workarounds
No reliable workaround without upgrading. Disabling multi-page forms or save-for-later reduces exposure but does not remove the vulnerability.
- Reported by Jorge González (jorge@jmilla.es)
Weakness: CWE-639 Authorization Bypass Through User-Controlled Key; CWE-862 Missing Authorization. Reported by Pig-Tail.
The advisory
- GitHub Advisory Database: GHSA-584p-f93j-wpgc, with who is affected and how
- OSV.dev: GHSA-584p-f93j-wpgc
- The week's digest, with the other advisories from 21 Sep 2026
- All advisories for verbb/formie