Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials
Impact
The control panel action formie/integrations/form-settings (IntegrationsController::actionFormSettings) was reachable by any authenticated user without the appropriate form integration permissions. The action applied request-supplied settings to a fully configured integration via setAttributes($settings, false), allowing an attacker to overwrite outbound host properties (e.g. apiUrl) while the server sent stored API keys or OAuth tokens to the attacker-controlled host. The remote response was returned in the JSON body (non-blind SSRF).
This is an incomplete remediation of GHSA-cvpc-hccg-wmw4. The form-settings action was excluded from the permission gate added in 3.1.28.
Any site where a low-privileged user can authenticate (including front-end members on sites with public registration) could exfiltrate CRM/email-marketing/webhook integration credentials and probe internal network endpoints.
Patches
Fixed in 3.1.31 (Craft 5) and 2.2.23 (Craft 4).
The action now requires a CP request, a valid formId, and form integration permissions (formie-showFormIntegrations / per-form variant on Craft 5; formie-manageFormIntegrations / per-form variant on Craft 4). Request settings are filtered to an allowlist; URL, host, and credential properties cannot be overridden from user input.
Workarounds
Restrict front-end user registration and limit CP access until upgraded. No configuration-only workaround fully mitigates the issue.
- Reported by Jorge González (jorge@jmilla.es)
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | verbb/formie | >= 3.0.0, < 3.1.31, < 2.2.23 | 3.1.31, 2.2.23 |
References
- https://github.com/verbb/formie/security/advisories/GHSA-v3f3-cmj4-cvj9
- https://github.com/verbb/formie/commit/6735fe4ae8f6a2a76930716ad7876b236f7c530d
- https://github.com/verbb/formie/commit/dde7799dfa7e4d0a11e28754ad8544dba62d5def
- https://github.com/advisories/GHSA-cvpc-hccg-wmw4
- https://github.com/verbb/formie
- https://github.com/verbb/formie/releases/tag/2.2.23
- https://github.com/verbb/formie/releases/tag/3.1.31
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N- Weakness (CWE)
CWE-862, CWE-915, CWE-918- Platform
- Composer
- Package
verbb/formie- Disclosed
- 23.09.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-v3f3-cmj4-cvj9 - CC BY 4.0
Vulnerability history: verbb/formie
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 10
- First → latest
- 05.2024 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 4
- Medium 4
Disclosures per year
- 2024: 1
- 2025: 2
- 2026: 7
-
Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.