Restricted fields manipulation In verbb/formie
Description
formie's unauthenticated front-end submission editing can overwrite existing submissions
Impact
Unauthenticated users could modify existing submissions by posting a known or guessed submission ID to formie/submissions/save-submission.
Patches
Workarounds
Block unauthenticated access to actions/formie/submissions/save-submission, or disable/customize front-end submission editing until patched.
Credit
formie extends many thanks to:
Florian (Cyber Security Engineer, arcade solutions ag)
Contact: security@arcade.ch
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 packagist | 3.1.26, 2.2.21 |
Aliases
1. 2. 3. 4. 5.
References
1. 2. 3.