{"action":"Upgrade verbb/formie to 2.2.21 or later.","affected":[{"fixed":"3.1.26","introduced":"3.0.0"},{"fixed":"2.2.21","introduced":"0"}],"component":"verbb/formie","cve_ids":["CVE-2026-47266"],"ecosystem":"Packagist","epss":0.00312,"exploited":false,"fixed_versions":["3.1.26","2.2.21"],"ghsa_id":"GHSA-pgxq-p76c-x9cg","id":"tcs_01M5KF6CD74SM99DS2VJPW4G29","modified_at":"2026-09-10T03:50:47.233741206Z","published_at":"2026-05-29T22:19:19Z","references":["https://osv.dev/vulnerability/GHSA-pgxq-p76c-x9cg","https://github.com/verbb/formie/security/advisories/GHSA-pgxq-p76c-x9cg","https://nvd.nist.gov/vuln/detail/CVE-2026-47266","https://github.com/verbb/formie","https://github.com/verbb/formie/releases/tag/2.2.21","https://github.com/verbb/formie/releases/tag/3.1.26"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-pgxq-p76c-x9cg","url":"https://osv.dev/vulnerability/GHSA-pgxq-p76c-x9cg"},{"source":"nvd","source_id":"CVE-2026-47266","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47266"}],"summary":"formie's unauthenticated front-end submission editing can overwrite existing submissions"}