CVE-2026-76087 Formie: Unauthenticated users can overwrite incomplete submissions via submit action

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a...

EUVD-2026-85547

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a...

CVE-2026-76087

The Formie Craft CMS plugin (prior to versions 2.2.23 and 3.1.31 ) contains an authorization bypass in the anonymous formie/submissions/submit action (SubmissionsController::actionSubmit). The component fails to perform session binding, ownership validation, or submissionEditToken verification wh...

CVE-2026-76087 Formie: Unauthenticated users can overwrite incomplete submissions via submit action

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a...

CVE-2026-76087 Formie: Unauthenticated users can overwrite incomplete submissions via submit action

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a...

CVE-2026-76086

The Formie Craft CMS plugin (versions prior to 2.2.23 and 3.1.31 ) contains a vulnerability where the formie/integrations/form-settings control panel action lacks proper permission checks. An authenticated attacker, including low-privileged or front-end users, can reach the IntegrationsController...

EUVD-2026-85545

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a...

CVE-2026-76086 Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a...

CVE-2026-76086 Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a...

CVE-2026-76086 Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a...

CVE-2026-76089 Formie: Missing authorization on sent notification resend modal exposes submission PII

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level...

CVE-2026-76089 Formie: Missing authorization on sent notification resend modal exposes submission PII

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level...

CVE-2026-76089

The Formie Craft CMS plugin (versions prior to 2.2.23 and 3.1.31 ) contains a missing authorization vulnerability in the SentNotificationsController::actionGetResendModalContent control panel action. The application fails to perform object-level authorization checks when loading a SentNotificatio...

EUVD-2026-85538

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level...

CVE-2026-76089 Formie: Missing authorization on sent notification resend modal exposes submission PII

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level...

CVE-2026-73858

Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in...

CLSA-2026-1790174106 TuxCare security update for craftcms/cms (1 CVE)

TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 3.9.15-p10+tuxcare...

Solspace Freeform: Limited Twig template injection via submitted field values

Summary A limited server-side Twig template injection issue was identified in Solspace Freeform for Craft CMS. In affected versions, submitted form field values could be evaluated as Twig in certain rendering contexts. Unauthenticated users could submit Twig expressions through public Freeform...

GHSA-GXRG-X694-283W Solspace Freeform: Limited Twig template injection via submitted field values

Summary A limited server-side Twig template injection issue was identified in Solspace Freeform for Craft CMS. In affected versions, submitted form field values could be evaluated as Twig in certain rendering contexts. Unauthenticated users could submit Twig expressions through public Freeform...

CVE-2026-73858

The Solspace Freeform plugin for Craft CMS (versions 5.0.0 through 5.10.13) is vulnerable to a limited server-side Twig template injection (SSTI). An unauthenticated attacker can submit Twig expressions through public Freeform forms; these expressions are evaluated by the isolated Twig renderer w...