Formie is a Craft CMS plugin that allows front‑end submission creation. An unauthenticated attack can alter any existing submission by sending a known or guessed submission ID to the /submissions/save-submission endpoint. This results in unauthorized change of data, a breach of data integrity, and potential exposure of sensitive form content. The weakness is a CWE‑639 unauthorized user access flaw.

The vulnerability affects installations of verbb:formie before version 2.2.21 and before version 3.1.26, i.e., any Formie plugin on Craft CMS that has not been updated to at least 2.2.21 or 3.1.26.

The CVSS score of 8.7 indicates high severity. Because the EPSS score is not provided, the likelihood of exploitation is unknown, but the vulnerability is not listed in the CISA KEV catalog, suggesting it has not been widely exploited yet. The likely attack vector is an unauthenticated HTTP POST to the vulnerable endpoint and relies on knowledge of a valid submission ID. If an attacker can guess or discover a submission ID, they can overwrite the data of any existing entry.