Formie Craft CMS Plugin Unauthenticated Submission Editing Vulnerability

A vulnerability in the Formie Craft CMS plugin, affecting versions prior to 2.2.21 and 3.1.26, allows unauthenticated users to modify existing form submissions. This is achieved by sending a known or guessed submission ID to the 'formie/submissions/save-submission' endpoint. The issue arises from insufficient access controls, enabling unauthorized manipulation of submission data.

Impact

Exploitation of this vulnerability allows for unauthorized modification of form submissions, potentially leading to data integrity issues.

Remediation

Users can upgrade to Formie version 2.2.21 or 3.1.26, both of which include the necessary patch. Alternatively, unauthenticated access to the 'actions/formie/submissions/save-submission' endpoint can be blocked, or front-end submission editing can be disabled or customized until the plugin is updated.