GHSA-pgxq-p76c-x9cg
formie's unauthenticated front-end submission editing can overwrite existing submissions
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | verbb/formie | >= 3.0.0, < 3.1.26 | 3.1.26 |
| Packagist | verbb/formie | < 2.2.21 | 2.2.21 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Unauthenticated users could modify existing submissions by posting a known or guessed submission ID to `formie/submissions/save-submission`.
### Patches
[2.2.21](https://github.com/verbb/formie/releases/tag/2.2.21), [3.1.26](https://github.com/verbb/formie/releases/tag/3.1.26)
### Workarounds
Block unauthenticated access to `actions/formie/submissions/save-submission`, or disable/customize front-end submission editing until patched.
### Credit
formie extends many thanks to:
- Florian (Cyber Security Engineer, arcade solutions ag)
- Contact: [[email protected]](mailto:[email protected])
References
External links from the advisory. They lead to third-party sites.