GHSA-584p-f93j-wpgc Formie: Unauthenticated users can overwrite incomplete submissions via submit action

• Packagist verbb/formie: >= 3.0.0, < 3.1.31 → fixed in 3.1.31 • Packagist verbb/formie: < 2.2.23 → fixed in 2.2.23

Impact The anonymous front-end action `formie/submissions/submit` (`SubmissionsController::actionSubmit`) trusted a client-supplied `submissionId` when loading an incomplete submission, with no session binding, ownership check, or edit token validation. An unauthenticated attacker could enumerate sequential submission IDs and overwrite or hijack another user's in-progress (multi-page / save-for-later) submission. Tampered data could be persisted and forwarded via notifications and integrations when the submission was completed. Completed submissions were not affected (`isIncomplete=true` filter). This is an incomplete remediation of GHSA-pgxq-p76c-x9cg, which added edit-token validation to `save-submission` but not to `submit`. Patches Fixed in 3.1.31 (Craft 5) and 2.2.23 (Craft 4). When resuming an existing submission on a site request, the submission ID must match the session-bound submission (`Form::getCurrentSubmission()`) or a valid `submissionEditToken` when `editingSubmission` is set. Cross-form submission ID reuse is also rejected. Workarounds No reliable workaround without upgrading. Disabling multi-page forms or save-for-later reduces exposure but does not remove the vulnerability. • Reported by Jorge González ([email protected])