The vulnerability CVE-2026-47266 in verbb formie (a Craft CMS plugin) is an authorization bypass (CWE-639) that permits unauthenticated attackers to alter existing form submissions by posting a known or guessed submission ID to the save-submission endpoint. This flaw exists in versions before 2.2.21 and from 3.0.0-beta.1 up to but not including 3.1.26. The issue is resolved in versions 2.2.21 and 3.1.26. The CVSS 4.0 score is 8.7, indicating high severity with network attack vector, no privileges or user interaction required, and high impact on integrity.

An attacker without authentication can modify existing form submissions by exploiting the authorization bypass, potentially leading to data integrity issues or manipulation of submitted data. There is no indication of confidentiality or availability impact. No known exploits in the wild have been reported.

Upgrade verbb formie to version 2.2.21 or later, or 3.1.26 or later, where this vulnerability is fixed. Since the vendor advisory confirms the fix in these versions, applying the official patch is the recommended remediation.