CVE-2026-76087: Formie: Unauthenticated users can overwrite incomplete submissions via submit action
The anonymous front-end action formie/submissions/submit (SubmissionsController::actionSubmit) trusted a client-supplied submissionId when loading an incomplete submission, with no session binding, ownership check, or edit token validation.
An unauthenticated attacker could enumerate sequential submission IDs and overwrite or hijack another user’s in-progress (multi-page / save-for-later) submission. Tampered data could be persisted and forwarded via notifications and integrations when the submission was completed.
Completed submissions were not affected (isIncomplete=true filter). This is an incomplete remediation of GHSA-pgxq-p76c-x9cg, which added edit-token validation to save-submission but not to submit.
References
- github.com/advisories/GHSA-584p-f93j-wpgc
- github.com/verbb/formie/commit/323c2fe647a76fbccadf749728ee4ad9420efee1
- github.com/verbb/formie/commit/78a298ac3baf85ac283988dfce9cd42c9b958f16
- github.com/verbb/formie/releases/tag/2.2.23
- github.com/verbb/formie/releases/tag/3.1.31
- github.com/verbb/formie/security/advisories/GHSA-584p-f93j-wpgc
- nvd.nist.gov/vuln/detail/CVE-2026-76087
Code Behaviors & Features
Detect and mitigate CVE-2026-76087 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →