Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass, Tampering
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862 and CWE-915.
Summary
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a configured integration. An authenticated attacker can replace outbound host properties such as apiUrl while the server uses stored API keys or OAuth tokens, causing non-blind server-side requests to an attacker-controlled or internal host and returning the remote response. This residual flaw remained because the permission gate added in version 3.1.28 excluded the form-settings action. Sites that permit low-privileged or front-end user authentication can therefore expose integration credentials and internal network responses. This issue is fixed in versions 2.2.23 and 3.1.31.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| verbb | formie | before 2.2.23; 3.0.0 to before 3.1.31 | 2.2.23, 3.1.31 | Patch available | CNA |
| — | verbb/formie (Packagist) | 3.0.0 to before 3.1.31 | 3.1.31 | Patch available | GHSA-v3f3-cmj4-cvj9 |
| — | verbb/formie (Packagist) | before 2.2.23 | 2.2.23 | Patch available | GHSA-v3f3-cmj4-cvj9 |
- formie Vendorverbb Affected before 2.2.23; 3.0.0 to before 3.1.31 Fixed in 2.2.23, 3.1.31 Patch available CNA
- verbb/formie (Packagist) Vendor— Affected 3.0.0 to before 3.1.31 Fixed in 3.1.31 Patch available GHSA-v3f3-cmj4-cvj9
- verbb/formie (Packagist) Vendor— Affected before 2.2.23 Fixed in 2.2.23 Patch available GHSA-v3f3-cmj4-cvj9
Remediation
- Fix · CNA formie (verbb) Fixed in 2.2.23, 3.1.31
- Fix · GHSA-v3f3-cmj4-cvj9 verbb/formie (Packagist) Fixed in 3.1.31 Advisory →
- Fix · GHSA-v3f3-cmj4-cvj9 verbb/formie (Packagist) Fixed in 2.2.23 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-76086
- 2026-10-03 Alias added: GHSA-v3f3-cmj4-cvj9
References
Other 6
- https://github.com/verbb/formie/security/advisories/GHSA-v3f3-cmj4-cvj9
- https://github.com/verbb/formie/commit/6735fe4ae8f6a2a76930716ad7876b236f7c530d
- https://github.com/verbb/formie/commit/dde7799dfa7e4d0a11e28754ad8544dba62d5def
- https://github.com/verbb/formie/releases/tag/2.2.23
- https://github.com/verbb/formie/releases/tag/3.1.31
- https://github.com/verbb/formie
More verbb vulnerabilities
- TI-2026-37985 Formie: Server-Side Template Injection in Formie Hidden field defaults CVSS 3.1CRITICAL 9.8
- TI-2026-33438 Formie: Pre-authenticated server-side template injection in Hidden fields CVSS 3.1CRITICAL 9.8
- TI-2026-34846 Formie: Unauthenticated front-end submission editing can overwrite existing submissions CVSS 4.0HIGH 8.7
- TI-2026-53255 Formie: Unauthenticated users can overwrite incomplete submissions via submit action CVSS 3.1HIGH 8.2
- TI-2020-10575 The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header. CVSS 3.1CRITICAL 9.1
- TI-2020-10552 An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. CVSS 3.1HIGH 8.8
Sources
- CVE-2026-76086 · CVE Program
- CVE-2026-76086 · NVD
- FIRST EPSS
- GHSA-v3f3-cmj4-cvj9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences