Formie EUVD-2026-85545

Requires an authenticated user account with any level of access - the vulnerable IntegrationsController::actionFormSettings action lacked the form-integration permission check, so no per-form or integration-management permission is needed. Exploitation is materially easier on sites that allow low-privileged or front-end user authentication, especially those with public/self registration, which the advisory highlights as the primary risk amplifier. A Formie integration (CRM, email-marketing, or webhook) must already be configured with stored API keys or OAuth tokens for credential exfiltration to yield value. Limiting factors: the target must run a vulnerable version (>=3.0.0 <3.1.31 on Craft 5, or <2.2.23 on Craft 4), some form of authentication is required (not fully unauthenticated), and closed-CP sites where only trusted staff can log in substantially reduce exposure. The advisory notes no configuration-only workaround fully mitigates the issue short of upgrading.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N = 8.5) reflects a genuinely serious, low-friction flaw: network-reachable, low complexity, only low privileges required, and no user interaction. The PR:L is the critical gating factor and the description explicitly widens it - sites permitting front-end/self-registration effectively lower the bar to any registered member, making PR:L close to unauthenticated in practice. The C:H rating is well-justified because the non-blind SSRF returns the remote response in the JSON body AND causes stored API keys/OAuth tokens to be sent to an attacker-controlled host, enabling both internal network probing and credential exfiltration. S:C is defensible because the server pivots to internal/attacker hosts (a different security authority). No EPSS score, no SSVC decision data, no KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis' - but the flaw is notable because it is an INCOMPLETE FIX of prior advisory GHSA-cvpc-hccg-wmw4 (the 3.1.28 permission gate excluded this action), meaning the vulnerability class was already known and scrutinized. Absence of EPSS/KEV likely reflects the niche Craft CMS ecosystem footprint rather than low technical severity. Real priority for any Formie site with open registration; lower urgency for closed-CP sites where only trusted staff authenticate.

An attacker registers or logs in as a low-privileged front-end member on a Craft CMS site running vulnerable Formie, then POSTs to the control-panel action formie/integrations/form-settings, supplying settings that overwrite a configured integration's apiUrl (and related host properties) via setAttributes. The server uses its stored CRM/email-marketing/webhook API keys or OAuth tokens to make a request to the attacker's host and returns the response, exfiltrating the credentials and enabling internal network reconnaissance. No public POC is referenced, but the advisory describes the mechanism in exploit-ready detail.