CVE-2026-47266: Formie Craft CMS Auth Bypass Vulnerability

CVE-2026-47266 Overview

CVE-2026-47266 is a broken access control vulnerability [CWE-639] in Formie, a Craft CMS plugin for building forms. Versions prior to 2.2.21 and 3.1.26 allow unauthenticated attackers to modify existing form submissions by posting a known or guessed submission ID to the formie/submissions/save-submission endpoint. The endpoint fails to verify that the requester is authorized to alter the targeted submission record. Attackers can tamper with submitted data without any credentials, session, or user interaction. The maintainers fixed the issue in Formie 2.2.21 and 3.1.26.

Critical Impact
Unauthenticated attackers can overwrite arbitrary form submissions over the network by guessing submission IDs, compromising the integrity of stored form data.

Affected Products

Formie plugin for Craft CMS, versions prior to 2.2.21 (2.x branch)
Formie plugin for Craft CMS, versions prior to 3.1.26 (3.x branch)
Craft CMS sites with the Formie plugin installed and accessible over the network

Discovery Timeline

2026-05-29 - CVE-2026-47266 published to NVD
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2026-47266

Vulnerability Analysis

Formie exposes a public controller action at formie/submissions/save-submission to handle form submissions from site visitors. In affected releases, the action accepts a submissionId (or equivalent identifier) parameter and loads the matching submission for update. The controller does not verify that the current request owns the submission or possesses the rights to modify it. An unauthenticated attacker who knows or guesses a valid submission ID can POST arbitrary field values to the endpoint and the plugin persists the changes.

The issue impacts integrity rather than confidentiality or availability. Submitted data including customer messages, application forms, or order details can be silently rewritten. Downstream workflows that act on submission content (notification emails, integrations, exports) may then process attacker-controlled values.

Root Cause

The root cause is a missing authorization check in the save-submission controller action [CWE-639, Authorization Bypass Through User-Controlled Key]. The handler treats the submission identifier as a sufficient capability and skips validation of ownership, session linkage, or CSRF-bound submission tokens. Any client able to reach the endpoint can therefore alter records belonging to other users.

Attack Vector

Exploitation requires only network access to a vulnerable Craft CMS site. An attacker iterates or guesses numeric submission IDs and issues a POST request to actions/formie/submissions/save-submission containing the target submissionId and the desired field overrides. Because submission IDs are sequential integers in Craft CMS, enumeration is trivial. No authentication, privilege, or user interaction is required.

No verified public exploit code is available at the time of writing. The vulnerability mechanism is documented in the GitHub Security Advisory GHSA-pgxq-p76c-x9cg.

Detection Methods for CVE-2026-47266

Indicators of Compromise

POST requests to /actions/formie/submissions/save-submission (or index.php?action=formie/submissions/save-submission) that include a submissionId parameter referencing an existing record.
Unexpected modifications to Formie submission rows where the dateUpdated value diverges from the original dateCreated without a corresponding admin action.
Web server logs showing sequential enumeration of submission IDs from a single source IP.

Detection Strategies

Inspect web server and Craft CMS request logs for POSTs to the save-submission action containing a submissionId value, especially from unauthenticated sessions.
Compare current submission field values against backup snapshots or notification emails sent at submission time to identify silent tampering.
Alert on anomalous request volumes to Formie endpoints originating from a single client.

Monitoring Recommendations

Forward Craft CMS and web server access logs to a centralized analytics platform and create rules for the formie/submissions/save-submission action path.
Track database audit trails on the formie_submissions table for updates that lack a matching authenticated admin session.
Monitor outbound notification volume from Formie to detect mass re-triggering caused by submission overwrites.

How to Mitigate CVE-2026-47266

Immediate Actions Required

Upgrade Formie to version 2.2.21 (2.x branch) or 3.1.26 (3.x branch) immediately.
Audit existing submissions for unexpected changes since the plugin was installed, focusing on records with mismatched dateUpdated timestamps.
Review and rotate any secrets or downstream actions that may have been triggered by tampered submission content.

Patch Information

The maintainers fixed CVE-2026-47266 in Formie 2.2.21 and Formie 3.1.26. Both releases add authorization checks to the save-submission controller so that unauthenticated requests can no longer modify existing submission records. Refer to the GitHub Security Advisory GHSA-pgxq-p76c-x9cg for full advisory details.

Workarounds

Restrict access to the formie/submissions/save-submission action at the web server or WAF layer to block requests that include a submissionId parameter from unauthenticated clients until patching is complete.
Disable public-facing Formie forms temporarily if upgrading cannot be performed in the short term.
Place the Craft CMS admin and form endpoints behind authentication or IP allowlisting where business requirements allow.

bash

# Upgrade Formie using Composer
composer require verbb/formie:^3.1.26
# or, for the 2.x branch
composer require verbb/formie:^2.2.21

# Apply pending Craft migrations after upgrade
php craft migrate/all
php craft project-config/apply