Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

Impact The control panel action formie/integrations/form-settings IntegrationsController::actionFormSettings was reachable by any authenticated user without the appropriate form integration permissions. The action applied request-supplied settings to a fully configured integration via...

CVE-2026-76086 Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a...

CVE-2026-76086 Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a...

PT-2026-97500

Name of the Vulnerable Software and Affected Versions Formie versions prior to 2.2.23 Formie versions prior to 3.1.31 Description An authenticated attacker can access the formie/integrations/form-settings control panel action within the IntegrationsController::actionFormSettings function without...