CVE-2026-76086: Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials
Impact
The control panel action formie/integrations/form-settings (IntegrationsController::actionFormSettings) was reachable by any authenticated user without the appropriate form integration permissions. The action applied request-supplied settings to a fully configured integration via setAttributes($settings, false), allowing an attacker to overwrite outbound host properties (e.g. apiUrl) while the server sent stored API keys or OAuth tokens to the attacker-controlled host. The remote response was returned in the JSON body (non-blind SSRF).
This is an incomplete remediation of GHSA-cvpc-hccg-wmw4. The form-settings action was excluded from the permission gate added in 3.1.28.
Any site where a low-privileged user can authenticate (including front-end members on sites with public registration) could exfiltrate CRM/email-marketing/webhook integration credentials and probe internal network endpoints.
Patches
Fixed in 3.1.31 (Craft 5) and 2.2.23 (Craft 4).
The action now requires a CP request, a valid formId, and form integration permissions (formie-showFormIntegrations / per-form variant on Craft 5; formie-manageFormIntegrations / per-form variant on Craft 4). Request settings are filtered to an allowlist; URL, host, and credential properties cannot be overridden from user input.
Workarounds
Restrict front-end user registration and limit CP access until upgraded. No configuration-only workaround fully mitigates the issue.
- Reported by Jorge González (jorge@jmilla.es)
Other sources
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a configured integration. An authenticated attacker can replace outbound host properties such as apiUrl while the server uses stored API keys or OAuth tokens, causing non-blind server-side requests to an attacker-controlled or internal host and returning the remote response. This residual flaw remained because the permission gate added in version 3.1.28 excluded the form-settings action. Sites that permit low-privileged or front-end user authentication can therefore expose integration credentials and internal network responses. This issue is fixed in versions 2.2.23 and 3.1.31.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/verbb/formieto a version that resolves this vulnerability.Fixed in 2.2.23 - Upgrade
Upgrade
composer/verbb/formieto a version that resolves this vulnerability.Fixed in 3.1.31 - Upgrade
Upgrade
Formie for Craft 5to a version that resolves this vulnerability.Fixed in 3.1.31 - Upgrade
Upgrade
Formie for Craft 4to a version that resolves this vulnerability.Fixed in 2.2.23 - Compensating control
Restrict front-end user registration and limit Control Panel access until Formie is upgraded.
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated user could reach the affected action without the required form integration permissions. This includes low-privileged front-end members where public registration permits them to authenticate.
What does an attacker need to do to exploit it?
The attacker needs an authenticated account and must submit request-supplied integration settings that overwrite an outbound host property such as apiUrl. The server can then send the configured integration's stored API key or OAuth token to an attacker-controlled host.
Are sites running the earlier permission fix still affected?
Yes. The permission gate added in 3.1.28 did not cover the form-settings action, making this an incomplete remediation of the earlier issue.
What versions contain the fix?
The issue is fixed in Formie 3.1.31 for Craft 5 and 2.2.23 for Craft 4. The fix restricts the action to CP requests, requires a valid formId, and enforces form integration permissions.
What is the potential impact if exploitation succeeds?
An attacker can exfiltrate stored credentials for CRM, email-marketing, or webhook integrations. They can also use the server to probe internal network endpoints, and receive remote responses in JSON rather than being limited to blind SSRF.