CVE-2026-47266highCWE-639

CVE-2026-47266: falha de alta gravidade em verbb formie

Formie: Unauthenticated front-end submission editing can overwrite existing submissions

Publicada em

Seguir esta CVE+ Monitorar formie+ Monitorar verbb/formie

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.3%
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.21 and 3.1.26, unauthenticated users could modify existing submissions by posting a known or guessed submission ID to formie/submissions/save-submission. This vulnerability is fixed in 2.2.21 and 3.1.26.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
verbb · formie
CVEs relacionadas — verbb formie

No mesmo produto, das mais perigosas para as menos.

CVE-2026-52889CRITICALFormie: Server-Side Template Injection in Formie Hidden field defaultsEPSS 1.3%CVE-2026-76086HIGHFormie: Integration form-settings action allows SSRF and exfiltration of stored integration credentialsEPSS 0.5%CVE-2026-45697CRITICALFormie: Pre-authenticated server-side template injection in Hidden fieldsEPSS 0.5%CVE-2026-76089HIGHFormie: Missing authorization on sent notification resend modal exposes submission PIIEPSS 0.4%CVE-2026-76087HIGHFormie: Unauthenticated users can overwrite incomplete submissions via submit actionEPSS 0.4%CVE-2024-35191MEDIUMverbb/formie Server-Side Template Injection for variable-enabled settingsEPSS 0.3%