{"id":"CVE-2026-76086","aliases":["GHSA-v3f3-cmj4-cvj9"],"url":"https://o3.security/vulnerability/CVE-2026-76086","summary":"Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials","details":"### Impact\n\nThe control panel action `formie/integrations/form-settings` (`IntegrationsController::actionFormSettings`) was reachable by any authenticated user without the appropriate form integration permissions. The action applied request-supplied settings to a fully configured integration via `setAttributes($settings, false)`, allowing an attacker to overwrite outbound host properties (e.g. `apiUrl`) while the server sent stored API keys or OAuth tokens to the attacker-controlled host. The remote response was returned in the JSON body (non-blind SSRF).\n\nThis is an incomplete remediation of [GHSA-cvpc-hccg-wmw4](https://github.com/advisories?query=GHSA-cvpc-hccg-wmw4). The `form-settings` action was excluded from the permission gate added in 3.1.28.\n\nAny site where a low-privileged user can authenticate (including front-end members on sites with public registration) could exfiltrate CRM/email-marketing/webhook integration credentials and probe internal network endpoints.\n\n### Patches\n\nFixed in **3.1.31** (Craft 5) and **2.2.23** (Craft 4).\n\nThe action now requires a CP request, a valid `formId`, and form integration permissions (`formie-showFormIntegrations` / per-form variant on Craft 5; `formie-manageFormIntegrations` / per-form variant on Craft 4). Request settings are filtered to an allowlist; URL, host, and credential properties cannot be overridden from user input.\n\n### Workarounds\n\nRestrict front-end user registration and limit CP access until upgraded. No configuration-only workaround fully mitigates the issue.\n\n- Reported by Jorge González (jorge@jmilla.es)","published":"2026-09-23T18:32:37.401Z","modified":"2026-10-21T02:59:32.264857477Z","cvss":{"score":8.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"verbb/formie","fixedVersion":"3.1.31"},{"ecosystem":"Packagist","name":"verbb/formie","fixedVersion":"2.2.23"}],"fix":{"url":"https://github.com/verbb/formie/commit/6735fe4ae8f6a2a76930716ad7876b236f7c530d","label":"verbb/formie@6735fe4"},"references":[{"type":"WEB","url":"https://github.com/verbb/formie/releases/tag/2.2.23"},{"type":"WEB","url":"https://github.com/verbb/formie/releases/tag/3.1.31"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76086.json"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-cvpc-hccg-wmw4"},{"type":"ADVISORY","url":"https://github.com/verbb/formie/security/advisories/GHSA-v3f3-cmj4-cvj9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76086"},{"type":"FIX","url":"https://github.com/verbb/formie/commit/6735fe4ae8f6a2a76930716ad7876b236f7c530d"},{"type":"FIX","url":"https://github.com/verbb/formie/commit/dde7799dfa7e4d0a11e28754ad8544dba62d5def"},{"type":"PACKAGE","url":"https://github.com/verbb/formie"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:59:32.264857477Z"}}