CVE-2026-76086: Craft Formie integration form-settings SSRF and credential exfiltration

CVE-2026-76086 · Severity: high · CVSS 8.5 · Published 2026-09-23

Formie is a form-building plugin for the Craft CMS platform used to create and manage web forms. A vulnerability in the integration settings action allows any authenticated user, including front-end members on sites with public registration, to redirect form integration API requests to attacker-controlled servers and steal stored credentials (API keys, OAuth tokens) for connected services like CRM or email marketing platforms. This could lead to unauthorized access to business-critical third-party services and customer data exposure.

Technologies: verbb/formie (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-76086 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-76086 being exploited in the wild.
How severe is CVE-2026-76086?
High severity, with a CVSS score of 8.5, published 23 September 2026.
Which products and versions are affected?
verbb/formie (Packagist) ECOSYSTEM:introduced=3.0.0,fixed=3.1.31.
Is there a fix for CVE-2026-76086?
Yes. verbb/formie (Packagist): upgrade to 3.1.31 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76086 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-76086?
Check whether you run verbb/formie (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • verbb/formie (Packagist): upgrade to 3.1.31 or later
    composer require verbb/formie:^3.1.31

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) combined with credential exfiltration in the `formie/integrations/form-settings` action of Formie's IntegrationsController. The action was reachable by any authenticated user without proper form integration permission checks and accepted user-supplied settings applied directly to fully configured integration objects via `setAttributes($settings, false)`, allowing an attacker to overwrite API endpoint URLs (e.g., `apiUrl`) while the server forwarded stored API keys or OAuth tokens to the attacker-controlled host. The non-blind SSRF returned the remote response in the JSON response body, confirming successful exfiltration. This is an incomplete fix of a prior SSRF (GHSA-cvpc-hccg-wmw4); the form-settings action was excluded from the permission gate added in version 3.1.28. Patches in versions 3.1.31 (Craft 5) and 2.2.23 (Craft 4) restrict the action to CP requests with proper permissions and filter settings to an allowlist preventing credential and URL override.

Affected products

  • Craft Formie < 3.1.31 (Craft 5), < 2.2.23 (Craft 4)

Identifiers

  • CVE-2026-76086
  • GHSA-v3f3-cmj4-cvj9

Timeline

  • 2026-09-23: disclosed
  • 2026-09-23: patched: 3.1.31 (Craft 5) and 2.2.23 (Craft 4)
  • 2026-09-23: advisory: GHSA-v3f3-cmj4-cvj9

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.