GHSA-pgxq-p76c-x9cg
formie's unauthenticated front-end submission editing can overwrite existing submissions
Quick fix
GHSA-pgxq-p76c-x9cg — verbb/formie: upgrade to the fixed version with the command below.
composer require verbb/formie:^3.1.26Details
### Impact Unauthenticated users could modify existing submissions by posting a known or guessed submission ID to `formie/submissions/save-submission`.
### Patches [2.2.21](https://github.com/verbb/formie/releases/tag/2.2.21), [3.1.26](https://github.com/verbb/formie/releases/tag/3.1.26)
### Workarounds Block unauthenticated access to `actions/formie/submissions/save-submission`, or disable/customize front-end submission editing until patched.
### Credit formie extends many thanks to: - Florian (Cyber Security Engineer, arcade solutions ag) - Contact: [security@arcade.ch](mailto:security@arcade.ch)
Are you affected?
Enter the version of the package you're using.