CVE-2026-76086: Craft CMS Formie Plugin SSRF Vulnerability

CVE-2026-76086 Overview

Formie is a form-building plugin for Craft CMS developed by Verbb. A missing authorization flaw in the formie/integrations/form-settings control panel action allows authenticated users to bypass integration permission checks. The vulnerable handler in IntegrationsController::actionFormSettings accepts request-supplied settings and passes them to configured integrations. An attacker can overwrite outbound host properties such as apiUrl while the server continues to use stored API keys or OAuth tokens. This produces non-blind server-side request forgery (SSRF) that returns the remote response, exposing integration credentials and internal network content.

Critical Impact
Low-privileged authenticated users can coerce Formie to issue outbound HTTP requests using stored credentials to attacker-controlled or internal hosts and read the responses.

Affected Products

Formie for Craft CMS versions prior to 2.2.23
Formie for Craft CMS 3.x versions prior to 3.1.31
Craft CMS sites permitting low-privileged or front-end user authentication

Discovery Timeline

2026-09-23 - CVE-2026-76086 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in the NVD database

Technical Details for CVE-2026-76086

Vulnerability Analysis

The defect is a missing authorization check [CWE-862] in the Formie control panel controller. The actionFormSettings handler in IntegrationsController was reachable without the form integration permission gate. Version 3.1.28 introduced a broader permission check for integration endpoints but did not cover the form-settings action. That gap left the endpoint exposed to any authenticated Craft CMS session, including front-end users.

Because the handler forwards request-supplied settings into the integration object, an attacker can alter transport-level fields such as apiUrl. The server then executes the outbound request with the operator-configured secrets already bound to the integration. The response body is returned to the caller, making this a non-blind SSRF that can also exfiltrate integration credentials embedded in outbound traffic.

Root Cause

The root cause is an absent authorization gate on a state-changing control panel action. actionFormSettings trusted authenticated session context without verifying the form integration permission. Combined with mass-assignment of integration properties from the request, this converts a settings preview action into a credentialed request proxy.

Attack Vector

An attacker with any authenticated Craft CMS session sends a request to the formie/integrations/form-settings endpoint. The payload references a configured integration and overrides host fields such as apiUrl to point at an internal service or attacker-controlled listener. Formie loads the stored API key or OAuth token, issues the outbound request, and returns the response. The attacker collects internal network content or captures replayed credentials at the destination.

php

// Security patch in src/controllers/IntegrationsController.php
// Adds ForbiddenHttpException support to enforce authorization on form-settings

 use yii\base\UnknownPropertyException;
 use yii\web\BadRequestHttpException;
+use yii\web\ForbiddenHttpException;
 use yii\web\Response;

 use Exception;

Source: GitHub Commit 6735fe4

php

// Companion patch in src/controllers/IntegrationsController.php

 namespace verbb\formie\controllers;

 use verbb\formie\Formie;
-use verbb\formie\base\IntegrationInterface;
 use verbb\formie\errors\IntegrationException;

 use Craft;

Source: GitHub Commit dde7799

Detection Methods for CVE-2026-76086

Indicators of Compromise

HTTP requests to /actions/formie/integrations/form-settings or formie/integrations/form-settings from low-privileged or front-end user sessions.
Outbound HTTP requests from the Craft CMS host to internal RFC1918 addresses, cloud metadata endpoints such as 169.254.169.254, or unexpected external domains sourced from Formie integrations.
POST bodies referencing integration classes with overridden apiUrl, host, or endpoint fields.

Detection Strategies

Review web server access logs for authenticated requests to the Formie integrations controller by non-administrative accounts.
Correlate application logs with egress firewall logs to identify Formie-originated requests to hosts that are not part of the approved integration destinations.
Alert on Craft CMS PHP-FPM or worker processes initiating connections to link-local, loopback, or internal-only network ranges.

Monitoring Recommendations

Enable request logging for all formie/integrations/* control panel actions and forward them to a central log platform.
Baseline the set of hostnames Formie contacts per integration and alert on deviations.
Monitor for integration credential reuse anomalies at third-party providers, including unusual source IPs or user-agent strings.

How to Mitigate CVE-2026-76086

Immediate Actions Required

Upgrade Formie to version 2.2.23 or 3.1.31 as applicable to your branch.
Rotate all API keys and OAuth tokens stored in Formie integrations, since credentials may have been used in attacker-directed requests.
Audit Craft CMS user accounts and disable or downgrade unnecessary authenticated or front-end user access.

Patch Information

Verbb published fixes in Formie 2.2.23 and Formie 3.1.31. The fix adds authorization enforcement to IntegrationsController::actionFormSettings, closing the gap left by the 3.1.28 permission update. See the GitHub Security Advisory GHSA-v3f3-cmj4-cvj9 for vendor guidance.

Workarounds

Restrict access to the Craft CMS control panel to trusted networks using web server or WAF rules until the patch is applied.
Block requests to formie/integrations/form-settings at a reverse proxy for any user group that does not require form integration management.
Apply egress filtering on the Craft CMS host to deny outbound traffic to internal ranges and cloud metadata endpoints.

bash

# Example nginx rule to block the vulnerable endpoint at the edge
location ~* /actions/formie/integrations/form-settings {
    deny all;
    return 403;
}