CVE-2026-76086

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a configured integration. An authenticated attacker can replace outbound host properties such as apiUrl while the server uses stored API keys or OAuth tokens, causing non-blind server-side requests to an attacker-controlled or internal host and returning the remote response. This residual flaw remained because the permission gate added in version 3.1.28 excluded the form-settings action. Sites that permit low-privileged or front-end user authentication can therefore expose integration credentials and internal network responses. This issue is fixed in versions 2.2.23 and 3.1.31.

• CWE-862
• CWE-915
• CWE-918

• https://github.com/advisories/GHSA-cvpc-hccg-wmw4
• https://github.com/verbb/formie/commit/6735fe4ae8f6a2a76930716ad7876b236f7c530d
• https://github.com/verbb/formie/commit/dde7799dfa7e4d0a11e28754ad8544dba62d5def
• https://github.com/verbb/formie/releases/tag/2.2.23
• https://github.com/verbb/formie/releases/tag/3.1.31
• https://github.com/verbb/formie/security/advisories/GHSA-v3f3-cmj4-cvj9

Published

Sep 23, 2026

Last Modified

Sep 23, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-76071Netis NC63 firmware through V3.0.0.3327 contains a stack-bas…9.8
• CVE-2026-76072The Continue CLI applies an incomplete denylist as its only …7.4
• CVE-2026-76073Label Studio does not scope the annotation detail endpoint t…8.8
• CVE-2026-76074The AutomatorWP – Automator plugin for no-code automations, …4.3
• CVE-2026-7608A vulnerability was detected in TRENDnet TEW-821DAP up to 1.…8
• CVE-2026-76081ZITADEL is an open source identity management platform. Prio…5.5
• CVE-2026-76087Formie is a Craft CMS plugin for creating forms. Prior to 2.…8.2
• CVE-2026-76089Formie is a Craft CMS plugin for creating forms. Prior to 2.…7.7
• CVE-2026-7609A flaw has been found in TRENDnet TEW-821DAP up to 1.12B01. …8.8
• CVE-2026-76098Mistune is a Python Markdown parser with renderers and plugi…7.5
• CVE-2026-7610A vulnerability has been found in TRENDnet TEW-821DAP 1.12B0…8.1
• CVE-2026-76104Dell ObjectScale, versions prior to 4.4.0.0, contains an Inc…5.5