GHSA-584p-f93j-wpgc

### Impact

The anonymous front-end action `formie/submissions/submit` (`SubmissionsController::actionSubmit`) trusted a client-supplied `submissionId` when loading an incomplete submission, with no session binding, ownership check, or edit token validation.

An unauthenticated attacker could enumerate sequential submission IDs and overwrite or hijack another user's in-progress (multi-page / save-for-later) submission. Tampered data could be persisted and forwarded via notifications and integrations when the submission was completed.

Completed submissions were not affected (`isIncomplete=true` filter). This is an incomplete remediation of [GHSA-pgxq-p76c-x9cg](https://github.com/advisories?query=GHSA-pgxq-p76c-x9cg), which added edit-token validation to `save-submission` but not to `submit`.

### Patches

Fixed in **3.1.31** (Craft 5) and **2.2.23** (Craft 4).

When resuming an existing submission on a site request, the submission ID must match the session-bound submission (`Form::getCurrentSubmission()`) or a valid `submissionEditToken` when `editingSubmission` is set. Cross-form submission ID reuse is also rejected.

### Workarounds

No reliable workaround without upgrading. Disabling multi-page forms or save-for-later reduces exposure but does not remove the vulnerability.

- Reported by Jorge González (jorge@jmilla.es)