[HIGH] Formie: Missing authorization on sent notification resend modal exposes submission PII

PKSA-4fhy-ttgn-65dd CVE-2026-76089 GHSA-9rg8-2wvr-fgjh

Affected version: <2.2.23|>=3.0.0,<3.1.31

Reported by:
GitHub

[HIGH] Formie: Unauthenticated users can overwrite incomplete submissions via submit action

PKSA-zdww-z1qy-tc3x CVE-2026-76087 GHSA-584p-f93j-wpgc

Affected version: <2.2.23|>=3.0.0,<3.1.31

Reported by:
GitHub

[HIGH] Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

PKSA-mwqg-ntj6-7bx8 CVE-2026-76086 GHSA-v3f3-cmj4-cvj9

Affected version: <2.2.23|>=3.0.0,<3.1.31

Reported by:
GitHub

[MEDIUM] Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration

PKSA-xm2v-2qmq-bmd3 GHSA-cvpc-hccg-wmw4

Affected version: <3.1.28

Reported by:
GitHub

[CRITICAL] Formie Hidden field defaults vulnerable to Server-Side Template Injection

PKSA-rm1g-8q6b-7djk CVE-2026-52889 GHSA-565m-g33j-jq96

Affected version: <3.1.27

Reported by:
GitHub

[HIGH] formie's unauthenticated front-end submission editing can overwrite existing submissions

PKSA-2h9w-qq3j-93vt CVE-2026-47266 GHSA-pgxq-p76c-x9cg

Affected version: <2.2.21|>=3.0.0,<3.1.26

Reported by:
GitHub

[CRITICAL] Formie: Pre-authenticated server-side template injection in Hidden fields

PKSA-snft-3cv8-v5p5 CVE-2026-45697 GHSA-x7m9-mwc2-g6w2

Affected version: <2.2.20|>=3.0.0-beta.1,<3.1.24

Reported by:
GitHub

[MEDIUM] Formie has XSS vulnerability for email notification content for preview

PKSA-q8g8-6f85-c3mh CVE-2025-32426 GHSA-2xm2-23ff-p8ww

Affected version: <=2.1.43

Reported by:
GitHub

[MEDIUM] Formie has XSS vulnerability for importing forms

PKSA-m8j6-b24d-gz5q CVE-2025-32427 GHSA-p9hh-mh5x-wvx3

Affected version: <=2.1.43

Reported by:
GitHub

[MEDIUM] verbb/formie Server-Side Template Injection for variable-enabled settings

PKSA-vzbr-51wf-rdg1 CVE-2024-35191 GHSA-v45m-hxqp-fwf5

Affected version: <2.1.6

Reported by:
GitHub