CVE-2026-76087: Craft CMS Formie Auth Bypass Vulnerability

CVE-2026-76087 Overview

CVE-2026-76087 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in Formie, a Craft CMS plugin for creating forms. The flaw affects the anonymous formie/submissions/submit action within SubmissionsController::actionSubmit. The controller trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a valid submissionEditToken. Unauthenticated attackers can enumerate sequential IDs and hijack in-progress multi-page or save-for-later submissions belonging to other users. This is an incomplete remediation of CVE-2026-47266, which addressed edit token validation for the save-submission action but did not extend that protection to submit.

Critical Impact
Unauthenticated attackers can overwrite or hijack another user's in-progress form submissions, with modified data persisted and forwarded through notifications or third-party integrations upon completion.

Affected Products

Formie plugin for Craft CMS versions prior to 2.2.23
Formie plugin for Craft CMS versions prior to 3.1.31
Craft CMS installations using multi-page or save-for-later form workflows

Discovery Timeline

2026-09-23 - CVE-2026-76087 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-76087

Vulnerability Analysis

The vulnerability resides in Formie's SubmissionsController::actionSubmit handler. The controller accepts a submissionId parameter from client requests and loads the corresponding submission record when it matches the isIncomplete filter. No verification exists to confirm the requester owns the submission or possesses a valid submissionEditToken. Completed submissions are excluded by the isIncomplete filter, limiting the attack surface to in-progress records.

Because the endpoint is reachable anonymously, an attacker can iterate over sequential submission IDs and rewrite payload fields for any active submission. When the legitimate user or attacker finalizes the submission, the tampered data enters downstream notifications, webhooks, and integrations as if it originated from the original submitter.

Root Cause

The root cause is missing authorization on a client-supplied object identifier, a classic IDOR pattern captured by [CWE-639]. The earlier fix for CVE-2026-47266 introduced _validateSubmissionEditToken checks on the save-submission action but left the submit action reliant on the raw ID alone. Session binding and ownership checks were never enforced on the submission path.

Attack Vector

Exploitation requires only network access to the form endpoint. An attacker sends a crafted POST request to formie/submissions/submit with an enumerated submissionId, overriding fields on a victim's in-progress submission. The manipulated content is persisted and later transmitted through configured notification pipelines and third-party integrations.

php

// Security patch in src/controllers/SubmissionsController.php
// Removes the front-end trust of submissionId on save-submission and blocks
// anonymous creation via site requests without an existing submission.

         // Get the submission, or create a new one
         $submission = $this->_populateSubmission($form, null);
 
-        if ($request->getIsSiteRequest() && $submission->id) {
-            $editingSubmission = $this->_getTypedParam('editingSubmission', 'boolean');
-
-            if (!$editingSubmission || !$this->_validateSubmissionEditToken($form, $submission)) {
-                throw new ForbiddenHttpException('User is not permitted to perform this action');
-            }
+        if ($request->getIsSiteRequest() && !$submission->id) {
+            throw new ForbiddenHttpException('User is not permitted to perform this action');
         }
 
         if ($currentUser && !$submission->canSave($currentUser)) {
// Source: https://github.com/verbb/formie/commit/78a298ac3baf85ac283988dfce9cd42c9b958f16

Detection Methods for CVE-2026-76087

Indicators of Compromise

Requests to /actions/formie/submissions/submit containing a submissionId parameter from clients that did not originate the submission session.
Sequential enumeration patterns against submissionId values from a single source IP within a short time window.
Unexpected changes to in-progress submission field values between the initial save and the completion event.
Notification or integration payloads containing content mismatched to the originating user's session or IP history.

Detection Strategies

Correlate submissionId values in HTTP request bodies with the session or cookie that created the submission and alert on mismatches.
Deploy web application firewall rules that flag high-volume POSTs to formie/submissions/submit with incrementing numeric IDs.
Review Craft CMS application logs for repeated ForbiddenHttpException entries or anomalous access to SubmissionsController::actionSubmit.

Monitoring Recommendations

Ingest Craft CMS and web server logs into a centralized analytics platform to baseline normal submission behavior.
Monitor outbound notification and integration traffic for content anomalies immediately following incomplete-to-complete state transitions.
Track version inventory of the Formie plugin across Craft CMS deployments and alert on installations below 2.2.23 or 3.1.31.

How to Mitigate CVE-2026-76087

Immediate Actions Required

Upgrade Formie to version 2.2.23 (for the 2.x branch) or 3.1.31 (for the 3.x branch) without delay.
Audit recent completed submissions for unexpected field modifications or content that does not match user intent.
Rotate any credentials, tokens, or downstream secrets that may have been transmitted through tampered notifications or integrations.

Patch Information

The maintainers released fixes in Formie 2.2.23 and Formie 3.1.31. Technical details are documented in the GitHub Security Advisory GHSA-584p-f93j-wpgc and the corresponding remediation commit.

Workarounds

Disable multi-page and save-for-later form workflows until patching is complete to eliminate in-progress submission records.
Restrict access to the formie/submissions/submit endpoint through a reverse proxy or WAF rule that enforces session-bound identifiers.
Increase logging verbosity on the Formie controller and monitor for anomalous submissionId reuse across distinct sessions.

bash

# Upgrade Formie using Composer to a patched release
composer require verbb/formie:^3.1.31
php craft migrate/all
php craft clear-caches/all