CVE-2026-76086 Details
Description
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a configured integration. An authenticated attacker can replace outbound host properties such as apiUrl while the server uses stored API keys or OAuth tokens, causing non-blind server-side requests to an attacker-controlled or internal host and returning the remote response. This residual flaw remained because the permission gate added in version 3.1.28 excluded the form-settings action. Sites that permit low-privileged or front-end user authentication can therefore expose integration credentials and internal network responses. This issue is fixed in versions 2.2.23 and 3.1.31.
A vulnerability exists in the Formie Craft CMS plugin, specifically in versions prior to 2.2.23 and 3.1.31. The issue arises from a missing authorization check in the 'formie/integrations/form-settings' control panel action, which is accessible without the necessary permissions. This flaw allows authenticated attackers to manipulate integration settings by overwriting outbound host properties, such as API URLs, while using stored API keys or OAuth tokens. The exploitation of this vulnerability results in non-blind server-side requests to an attacker-controlled or internal host, with the remote response returned to the attacker. This vulnerability could be exploited by low-privileged users on sites with public registration.
Users can upgrade to Formie versions 2.2.23 or 3.1.31 to address this vulnerability. Instructions for updating the plugin can be found in the Formie GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 23, 2026CISA-ADP
Assessed Sep 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/advisories/GHSA-cvpc-hccg-wmw4 | [email protected] | AdvisoryRemedyVendor |
| https://github.com/verbb/formie/commit/6735fe4ae8f6a2a76930716ad7876b236f7c530d | [email protected] | Source CodeVendor |
| https://github.com/verbb/formie/commit/dde7799dfa7e4d0a11e28754ad8544dba62d5def | [email protected] | Source CodeVendor |
| https://github.com/verbb/formie/releases/tag/2.2.23 | [email protected] | Release NotesVendor |
| https://github.com/verbb/formie/releases/tag/3.1.31 | [email protected] | Release NotesVendor |
| https://github.com/verbb/formie/security/advisories/GHSA-v3f3-cmj4-cvj9 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| verbb/formie | < 3.1.31 (semver) < 2.2.23 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 29, 2026 | CVE Modified | CISA-ADP |
| Sep 23, 2026 | New CVE Received | [email protected] |