CVE-2026-47266: Formie: Unauthenticated front-end submission editing can overwrite existing submissions

Synopsis

An access-control flaw in the Formie plugin for Craft CMS lets unauthenticated callers overwrite existing form submissions by POSTing a known or guessed submission ID to the formie/submissions/save-submission endpoint. The endpoint is reachable over the network with no authentication or victim interaction, and successful exploitation tampers with stored submission records (integrity impact only, no disclosure or denial of service). Patched releases 2.2.21 and 3.1.26 are published upstream, and patched-image rebuilds at the fix versions are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Craft CMS site hosting Formie over the network (AV:N), typically any internet-exposed form endpoint.

• AuthenticationNot required

  No credentials or session are needed (PR:N); any anonymous visitor can POST to the save-submission action.

• Victim interactionNot required

  Exploitation is server-side and does not require any user to click, view, or approve anything (UI:N).

• Attack complexityDetail

  Attack complexity is low (AC:L); the only prerequisite is knowing or guessing a valid submission ID, and submission IDs are typically sequential integers.

Blast Radius

• Overwrites the contents of existing Formie submissions, corrupting stored form data such as contact requests, applications, or survey responses.
• Enables targeted tampering when an attacker can guess or enumerate submission IDs, for example replacing a legitimate submitter's email or message body with attacker-controlled values.
• Does not expose submission contents to the attacker and does not crash the service; impact is limited to integrity of stored submissions (VC:N, VA:N, VI:H).