CVE-2026-76086 in Formie Plugin
Summary
by MITRE • 09/23/2026
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a configured integration. An authenticated attacker can replace outbound host properties such as apiUrl while the server uses stored API keys or OAuth tokens, causing non-blind server-side requests to an attacker-controlled or internal host and returning the remote response. This residual flaw remained because the permission gate added in version 3.1.28 excluded the form-settings action. Sites that permit low-privileged or front-end user authentication can therefore expose integration credentials and internal network responses. This issue is fixed in versions 2.2.23 and 3.1.31.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in Formie, a popular plugin for Craft CMS used to create web forms, represents a critical authorization bypass that allows authenticated attackers to manipulate integration configurations. Specifically, the flaw resides within the formie/integrations/form-settings control panel action located in the IntegrationsController::actionFormSettings method. Prior to versions 2.2.23 and 3.1.31, this endpoint was accessible without enforcing the necessary permissions required for managing form integrations. This oversight creates a significant security gap where any authenticated user, including those with low-privilege accounts or front-end users if such authentication is permitted on the site, can interact directly with integration settings that should be restricted to administrators or privileged roles.
The technical core of this vulnerability lies in the improper access control mechanism implemented during previous updates. Although a permission gate was introduced in version 3.1.28 to restrict access to certain integration actions, it inadvertently excluded the form-settings action from its scope. Consequently, attackers can supply request parameters that modify outbound host properties for configured integrations. By altering fields such as apiUrl, an attacker can redirect the server's outgoing requests away from legitimate endpoints and toward hosts controlled by the attacker or internal network resources. This manipulation is particularly dangerous because it leverages stored credentials associated with the integration, such as API keys or OAuth tokens, which are automatically attached to these outbound requests due to how the plugin handles authentication for integrations.
The operational impact of this flaw extends beyond simple data exfiltration from external services. Because the server performs non-blind server-side requests using its own identity and stored secrets, an attacker can achieve Server-Side Request Forgery (SSRF) effects that are fully interactive. The remote response is returned to the attacker through the application's normal request-response cycle, allowing for detailed reconnaissance of internal network infrastructure or unauthorized access to sensitive data hosted on external services protected by API keys. This effectively turns a form submission feature into a vector for credential theft and internal network mapping, compromising both confidentiality and integrity of the system's integrations.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Assignment, as it involves an actor obtaining privileges or accessing resources that they are not authorized to access. It also relates closely to CWE-434 Unrestricted Upload of File with Dangerous Type if the integration allows file handling, but more accurately fits CWE-918 Server-Side Request Forgery (SSRF) due to the ability to control outbound requests and leverage stored credentials for those requests. In terms of MITRE ATT&CK framework tactics, this behavior corresponds to Initial Access via valid accounts and potentially Lateral Movement if internal services are targeted using stolen tokens or keys.
To mitigate this risk, organizations running Formie must immediately upgrade to version 2.2.23 or 3.1.31, which include the corrected permission checks for the form-settings action. For sites that cannot update immediately due to compatibility constraints, it is critical to restrict access to the Craft CMS control panel and ensure that only highly privileged administrators have accounts with permissions to manage integrations. Additionally, implementing strict input validation on all integration configuration endpoints and auditing existing user roles can help minimize the attack surface until a patch is applied. Regular security audits of third-party plugins are essential to identify such residual flaws where partial fixes may leave specific vectors exposed.