CVE-2026-76086
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In the Formie plugin for Craft CMS prior to 2.2.23 and 3.1.31, the formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a configured integration. An authenticated attacker can replace outbound host properties such as apiUrl while the server uses stored API keys or OAuth tokens, causing non-blind server-side requests to an attacker-controlled or internal host and returning the remote response.
Risk Assessment
An authenticated attacker can expose integration credentials and internal network responses by making server-side requests to arbitrary hosts. Sites that permit low-privileged or front-end user authentication are particularly at risk.
Recommendation
Upgrade the Formie plugin to version 2.2.23 or 3.1.31 (or later) and restrict low-privileged user authentication and front-end access.
Other vulnerabilities in Formie
See all- CVE-2026-52889Critical
Formie, a Craft CMS plugin for creating forms, before version 3.1.27 passes request-derived Hidden field defaults (e.g., User Agent, URL, query parameters) to Craft's Twig rendering layer. An unauthenticated attacker can place Twig syntax in these values, leading to server-side template evaluation (SSTI), potentially resulting in information disclosure, application state modification, or remote code execution.
- CVE-2026-45697Critical
Formie, a Craft CMS plugin, prior to versions 2.2.20 and 3.1.24 allows unauthenticated users to submit crafted values into Hidden fields that are evaluated as Twig during submission handling. This can lead to serious compromise of the Craft site.
- CVE-2026-76089High
In the Formie plugin for Craft CMS prior to 2.2.23 and 3.1.31, the formie/sent-notifications/get-resend-modal-content action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level authorization checks. Any authenticated user able to invoke the action can enumerate notification IDs and read recipient headers and complete HTML email bodies containing submitted form data, even without the sent-notification viewing permission.
- CVE-2026-76087High
In the Formie plugin for Craft CMS prior to 2.2.23 and 3.1.31, the anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a valid submissionEditToken. An unauthenticated attacker can enumerate sequential IDs and overwrite or hijack another user's in-progress multi-page or save-for-later submission, and the modified data can be persisted and forwarded through notifications or integrations when the submission is completed.
- CVE-2026-47266High
The Formie plugin for Craft CMS before versions 2.2.21 and 3.1.26 allowed unauthenticated users to modify existing submissions by posting a known or guessed submission ID to the formie/submissions/save-submission endpoint.
Original NVD description (English source)
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a configured integration. An authenticated attacker can replace outbound host properties such as apiUrl while the server uses stored API keys or OAuth tokens, causing non-blind server-side requests to an attacker-controlled or internal host and returning the remote response. This residual flaw remained because the permission gate added in version 3.1.28 excluded the form-settings action. Sites that permit low-privileged or front-end user authentication can therefore expose integration credentials and internal network responses. This issue is fixed in versions 2.2.23 and 3.1.31.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS