CVE-2026-47266 Formie: Unauthenticated front-end submission editing can overwrite existing submissions
Unauthenticated attackers can modify existing form submissions by guessing IDs, allowing unauthorized data alteration in Craft CMS installations using Formie.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47266?
CVE-2026-47266 is a high-severity missing authorization vulnerability in verbb formie, published on 29 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.21 and 3.1.26, unauthenticated users could modify existing submissions by posting a known or guessed submission ID to formie/submissions/save-submission. This vulnerability is fixed in 2.2.21 and 3.1.26.
Weakness: CWE-639
Which versions are affected by CVE-2026-47266?
4 open source packages ship an affected version, including verbb/formie.
| Package | Affected | Fixed in |
|---|---|---|
verbb/formie Packagist | All versions | 2.2.21 |
verbb/formie Packagist | All versions | 2.2.21 |
verbb/formie Packagist | From 3.0.0 | 3.1.26 |
verbb/formie Packagist | From 3.0.0 | 3.1.26 |
How do I fix CVE-2026-47266?
Upgrade verbb/formie to a fixed version for your release line: 2.2.21 or 3.1.26.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-47266 being exploited?
There is no known exploitation of CVE-2026-47266 in the wild and no public exploit code.
Sources
Also known as GHSA-pgxq-p76c-x9cg.