AIKIDO-2026-571714
verbb/formie is vulnerable to Insecure Direct Object Reference (IDOR)
65
Medium Risk
This Affects:
verbb/formieTL;DR
Formie lets a logged in front end member edit a form submission by its identifier, and the ownership check added in an earlier release only blocks unauthenticated guest requests. It never confirms that the submission belongs to the requesting member. An authenticated member who is not a Control Panel user can supply another member's submission identifier and overwrite that submission's content. The fix adds an ownership check for authenticated members who are not Control Panel users.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you allow authenticated front end members to edit their own form submissions.
Background info
verbb/formie is vulnerable to Insecure Direct Object Reference (IDOR) in versions 0.0.1 - 3.1.43.
How to fix this
Upgrade the verbb/formie library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.