Search: CVE-2026-47266

CVE-2026-47266 is a high-severity authorization bypass vulnerability in the verbb Formie plugin for Craft CMS. Before versions 2.2.21 and 3.1.26, unauthenticated users could modify existing form submissions by submitting a known or guessed submission ID to the endpoint formie/submissions/save-submission. This allows unauthorized modification of form data. The issue is fixed in versions 2.2.21 and 3.