Vulnerability-Lookup

GHSA-V3F3-CMJ4-CVJ9

Vulnerability from github – Published: 2026-09-23 18:33 – Updated: 2026-09-23 18:33

Summary

Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

Details

Impact

The control panel action formie/integrations/form-settings (IntegrationsController::actionFormSettings) was reachable by any authenticated user without the appropriate form integration permissions. The action applied request-supplied settings to a fully configured integration via setAttributes($settings, false), allowing an attacker to overwrite outbound host properties (e.g. apiUrl) while the server sent stored API keys or OAuth tokens to the attacker-controlled host. The remote response was returned in the JSON body (non-blind SSRF).

This is an incomplete remediation of GHSA-cvpc-hccg-wmw4. The form-settings action was excluded from the permission gate added in 3.1.28.

Any site where a low-privileged user can authenticate (including front-end members on sites with public registration) could exfiltrate CRM/email-marketing/webhook integration credentials and probe internal network endpoints.

Patches

Fixed in 3.1.31 (Craft 5) and 2.2.23 (Craft 4).

The action now requires a CP request, a valid formId, and form integration permissions (formie-showFormIntegrations / per-form variant on Craft 5; formie-manageFormIntegrations / per-form variant on Craft 4). Request settings are filtered to an allowlist; URL, host, and credential properties cannot be overridden from user input.

Workarounds

Restrict front-end user registration and limit CP access until upgraded. No configuration-only workaround fully mitigates the issue.

Reported by Jorge González (jorge@jmilla.es)

Severity

8.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "verbb/formie"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.1.31"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "verbb/formie"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.23"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-76086"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862",
      "CWE-915",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-23T18:33:57Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\n\nThe control panel action `formie/integrations/form-settings` (`IntegrationsController::actionFormSettings`) was reachable by any authenticated user without the appropriate form integration permissions. The action applied request-supplied settings to a fully configured integration via `setAttributes($settings, false)`, allowing an attacker to overwrite outbound host properties (e.g. `apiUrl`) while the server sent stored API keys or OAuth tokens to the attacker-controlled host. The remote response was returned in the JSON body (non-blind SSRF).\n\nThis is an incomplete remediation of [GHSA-cvpc-hccg-wmw4](https://github.com/advisories?query=GHSA-cvpc-hccg-wmw4). The `form-settings` action was excluded from the permission gate added in 3.1.28.\n\nAny site where a low-privileged user can authenticate (including front-end members on sites with public registration) could exfiltrate CRM/email-marketing/webhook integration credentials and probe internal network endpoints.\n\n### Patches\n\nFixed in **3.1.31** (Craft 5) and **2.2.23** (Craft 4).\n\nThe action now requires a CP request, a valid `formId`, and form integration permissions (`formie-showFormIntegrations` / per-form variant on Craft 5; `formie-manageFormIntegrations` / per-form variant on Craft 4). Request settings are filtered to an allowlist; URL, host, and credential properties cannot be overridden from user input.\n\n### Workarounds\n\nRestrict front-end user registration and limit CP access until upgraded. No configuration-only workaround fully mitigates the issue.\n\n- Reported by Jorge Gonz\u00e1lez (jorge@jmilla.es)",
  "id": "GHSA-v3f3-cmj4-cvj9",
  "modified": "2026-09-23T18:33:57Z",
  "published": "2026-09-23T18:33:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/verbb/formie/security/advisories/GHSA-v3f3-cmj4-cvj9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/verbb/formie/commit/6735fe4ae8f6a2a76930716ad7876b236f7c530d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/verbb/formie/commit/dde7799dfa7e4d0a11e28754ad8544dba62d5def"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-cvpc-hccg-wmw4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/verbb/formie"
    },
    {
      "type": "WEB",
      "url": "https://github.com/verbb/formie/releases/tag/2.2.23"
    },
    {
      "type": "WEB",
      "url": "https://github.com/verbb/formie/releases/tag/3.1.31"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials"
}

CVE-2026-76086 (GCVE-0-2026-76086)

Vulnerability from cvelistv5 – Published: 2026-09-23 18:32 – Updated: 2026-09-23 18:32

Title

Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

Summary

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a configured integration. An authenticated attacker can replace outbound host properties such as apiUrl while the server uses stored API keys or OAuth tokens, causing non-blind server-side requests to an attacker-controlled or internal host and returning the remote response. This residual flaw remained because the permission gate added in version 3.1.28 excluded the form-settings action. Sites that permit low-privileged or front-end user authentication can therefore expose integration credentials and internal network responses. This issue is fixed in versions 2.2.23 and 3.1.31.

Severity

8.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

CWE

CWE-862 - Missing Authorization
CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M mitre root

References

6 references

URL	Tags
https://github.com/verbb/formie/security/advisori…	x_refsource_CONFIRM
https://github.com/verbb/formie/commit/6735fe4ae8…	x_refsource_MISC
https://github.com/verbb/formie/commit/dde7799dfa…	x_refsource_MISC
https://github.com/advisories/GHSA-cvpc-hccg-wmw4	x_refsource_MISC
https://github.com/verbb/formie/releases/tag/2.2.23	x_refsource_MISC
https://github.com/verbb/formie/releases/tag/3.1.31	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
verbb	formie	Affected: < 2.2.23 Affected: >= 3.0.0, < 3.1.31

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "formie",
          "vendor": "verbb",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.2.23"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.1.31"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie\u0027s formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a configured integration. An authenticated attacker can replace outbound host properties such as apiUrl while the server uses stored API keys or OAuth tokens, causing non-blind server-side requests to an attacker-controlled or internal host and returning the remote response. This residual flaw remained because the permission gate added in version 3.1.28 excluded the form-settings action. Sites that permit low-privileged or front-end user authentication can therefore expose integration credentials and internal network responses. This issue is fixed in versions 2.2.23 and 3.1.31."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-915",
              "description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T18:32:37.401Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/verbb/formie/security/advisories/GHSA-v3f3-cmj4-cvj9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/verbb/formie/security/advisories/GHSA-v3f3-cmj4-cvj9"
        },
        {
          "name": "https://github.com/verbb/formie/commit/6735fe4ae8f6a2a76930716ad7876b236f7c530d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/verbb/formie/commit/6735fe4ae8f6a2a76930716ad7876b236f7c530d"
        },
        {
          "name": "https://github.com/verbb/formie/commit/dde7799dfa7e4d0a11e28754ad8544dba62d5def",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/verbb/formie/commit/dde7799dfa7e4d0a11e28754ad8544dba62d5def"
        },
        {
          "name": "https://github.com/advisories/GHSA-cvpc-hccg-wmw4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/advisories/GHSA-cvpc-hccg-wmw4"
        },
        {
          "name": "https://github.com/verbb/formie/releases/tag/2.2.23",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/verbb/formie/releases/tag/2.2.23"
        },
        {
          "name": "https://github.com/verbb/formie/releases/tag/3.1.31",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/verbb/formie/releases/tag/3.1.31"
        }
      ],
      "source": {
        "advisory": "GHSA-v3f3-cmj4-cvj9",
        "discovery": "UNKNOWN"
      },
      "title": "Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-76086",
    "datePublished": "2026-09-23T18:32:37.401Z",
    "dateReserved": "2026-08-18T21:17:32.200Z",
    "dateUpdated": "2026-09-23T18:32:37.401Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted