Formie: Unauthenticated users can overwrite incomplete submissions via submit action
High · CVSS 8.2
### Impact The anonymous front-end action `formie/submissions/submit` (`SubmissionsController::actionSubmit`) trusted a client-supplied `submissionId` when loading an incomplete submission, with no session binding, ownership check, or edit token validation. An unauthenticated attacker could enumerate sequential submission IDs and overwrite or hijack another user's in-progress (multi-page / save-for-later) submission. Tampered data could be persisted and forwarded via notifications and integrations when the submission was completed.
Remediation
Upgrade verbb/formie to 3.1.31 or later. Upgrade verbb/formie to 2.2.23 or later.
Affected PHP branches
See the source advisory.
Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-584p-f93j-wpgc