Summary
Formie contains an authorization flaw in its anonymous submission endpoint that trusts a client-supplied identifier when loading incomplete submissions. An unauthenticated attacker who can identify another user's in-progress submission may overwrite or hijack its data, which could later be persisted or forwarded through notifications and integrations.
Affected context
The issue occurs in Formie deployments that support multi-page or save-for-later submissions through the anonymous formie/submissions/submit action. Risk arises when an incomplete submission is selected using a client-controlled submissionId without session binding, ownership validation, or a valid submission edit token. Completed submissions are excluded by the incomplete-submission filter.
Exploit preconditions
- Attack surface: Publicly reachable Formie submission endpoint
- Required access: No authentication is generally required
- Trigger point: Submission of data to the anonymous
formie/submissions/submitaction - Required condition: An incomplete submission must exist and its identifier must be discoverable or guessable
- Why exploitation is possible: The endpoint accepts a client-supplied identifier without adequately verifying session ownership or a valid edit token
Why this happens
The underlying bug is an authorization failure involving a user-controlled object reference. The application loads an incomplete submission based on the supplied identifier but does not consistently bind that object to the requesting user's session or require a valid capability token before allowing updates. This maps primarily to CWE-639: Authorization Bypass Through User-Controlled Key, with CWE-862: Missing Authorization also applicable because the update operation lacks an effective ownership or permission check.
Potential impact
- An attacker may overwrite another user's in-progress form data
- An attacker could hijack or corrupt a multi-page or save-for-later submission
- Sensitive information may be altered before final submission
- Modified data could be persisted in the application
- Altered content may be forwarded through notifications or external integrations
- Business workflows and submission records could suffer integrity loss
General mitigation guidance
Mitigation generally focuses on enforcing authorization at the point where an incomplete submission is loaded and modified.
Common defensive patterns include:
- Bind submissions to an authenticated session, user identity, or other non-forgeable ownership context
- Require a cryptographically strong, scoped, and validated edit token for every update path
- Avoid treating sequential or client-controlled identifiers as authorization credentials
- Apply consistent ownership and permission checks across save, submit, resume, and multi-page workflows
- Use deny-by-default authorization for anonymous submission operations
- Limit notification and integration permissions so compromised or altered records have minimal downstream reach
- Record and monitor failed ownership, token, and access validations
How teams detect issues like this
Detection can include static analysis and code review for controller actions that load records directly from request parameters before authorization checks.
Useful signals include:
- Client-controlled identifiers used in database lookups without session, owner, or token validation
- Anonymous endpoints that update persisted objects
- Authorization checks implemented for one workflow path but absent from equivalent paths
- Sequential identifiers exposed in URLs, forms, or API requests
- Tests that fail to verify cross-user access to incomplete records
Dynamic testing can use separate test users and attempts to access or modify each other's in-progress submissions. Automated security review tools and CI policy checks may help identify missing authorization patterns.
