Unauthorized Access Flaw in Craft CMS Plugin Affecting Formie by Verbb

CVE-2026-76086

What is CVE-2026-76086?

The Formie plugin for Craft CMS has a vulnerability where the form settings control panel action can be accessed without the necessary permissions, prior to versions 2.2.23 and 3.1.31. This flaw allows an authenticated attacker to modify outbound host properties, potentially exposing integration credentials and enabling unauthorized server-side requests to attacker-controlled hosts. The issue arose because the permission checks did not adequately cover the form settings action. Users with low-privileged authentication may find sensitive information compromised as a result. This vulnerability has been addressed in the latest versions.

References