Executive brief
Formie is a form-building plugin for the Craft CMS platform used to create and manage web forms. A vulnerability in the integration settings action allows any authenticated user, including front-end members on sites with public registration, to redirect form integration API requests to attacker-controlled servers and steal stored credentials (API keys, OAuth tokens) for connected services like CRM or email marketing platforms. This could lead to unauthorized access to business-critical third-party services and customer data exposure.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) combined with credential exfiltration in the `formie/integrations/form-settings` action of Formie's IntegrationsController. The action was reachable by any authenticated user without proper form integration permission checks and accepted user-supplied settings applied directly to fully configured integration objects via `setAttributes($settings, false)`, allowing an attacker to overwrite API endpoint URLs (e.g., `apiUrl`) while the server forwarded stored API keys or OAuth tokens to the attacker-controlled host. The non-blind SSRF returned the remote response in the JSON response body, confirming successful exfiltration. This is an incomplete fix of a prior SSRF (GHSA-cvpc-hccg-wmw4); the form-settings action was excluded from the permission gate added in version 3.1.28. Patches in versions 3.1.31 (Craft 5) and 2.2.23 (Craft 4) restrict the action to CP requests with proper permissions and filter settings to an allowlist preventing credential and URL override.
Affected products
- Craft Formie < 3.1.31 (Craft 5), < 2.2.23 (Craft 4)
Timeline
- 2026-09-23: disclosed
- 2026-09-23: patched: 3.1.31 (Craft 5) and 2.2.23 (Craft 4)
- 2026-09-23: advisory: GHSA-v3f3-cmj4-cvj9