Formie
Monthly
Missing authorization in Formie's IntegrationsController::actionFormSettings control panel action lets any authenticated user (no integration permission required) override outbound host properties such as apiUrl on an already-configured integration, causing the server to send stored API keys or OAuth tokens to an attacker-controlled or internal host and return the remote response in the JSON body. This is a non-blind SSRF combined with credential exfiltration affecting verbb/formie versions before 2.2.23 (Craft 4) and 3.0.0 through 3.1.30 (Craft 5); patched releases are 2.2.23 and 3.1.31. Authentication with any level of access is required, so exposure is greatest on sites permitting low-privileged or front-end/member authentication (including public self-registration), and a CRM, email-marketing, or webhook integration must already be configured with stored credentials for exfiltration to be meaningful; no public exploit code was identified at time of analysis, and the flaw is an incomplete remediation of GHSA-cvpc-hccg-wmw4, whose 3.1.28 permission gate omitted this action.
Information disclosure in Formie, the Craft CMS form-building plugin from Verbb, lets any authenticated control-panel user (CVSS vector PR:L, unauthenticated exploitation is not possible) read the full contents of sent form-submission notification emails - recipient headers and complete HTML bodies containing submitted form data - by enumerating notification IDs through the formie/sent-notifications/get-resend-modal-content action. The flaw bypasses the formie-viewSentNotifications permission entirely, so accounts that were never granted permission to view sent notifications can still retrieve them; it affects releases prior to 2.2.23 in the 2.x line and prior to 3.1.31 in the 3.x line. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing, so exploitability depends on an attacker first obtaining any low-privilege Craft CMS control-panel account.
Unauthorized submission modification in Formie (Craft CMS plugin) versions prior to 2.2.21 and 3.1.26 allows remote unauthenticated attackers to overwrite existing form submissions by POSTing a known or guessed submission ID to the formie/submissions/save-submission endpoint. The flaw is an authorization bypass (CWE-639) that compromises integrity of stored submission data without requiring credentials. No public exploit identified at time of analysis, though the upstream fix and advisory are publicly disclosed on GitHub.
Formie is a Craft CMS plugin for creating forms. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Formie is a Craft CMS plugin for creating forms. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Formie is a Craft CMS plugin for creating forms. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity.
Missing authorization in Formie's IntegrationsController::actionFormSettings control panel action lets any authenticated user (no integration permission required) override outbound host properties such as apiUrl on an already-configured integration, causing the server to send stored API keys or OAuth tokens to an attacker-controlled or internal host and return the remote response in the JSON body. This is a non-blind SSRF combined with credential exfiltration affecting verbb/formie versions before 2.2.23 (Craft 4) and 3.0.0 through 3.1.30 (Craft 5); patched releases are 2.2.23 and 3.1.31. Authentication with any level of access is required, so exposure is greatest on sites permitting low-privileged or front-end/member authentication (including public self-registration), and a CRM, email-marketing, or webhook integration must already be configured with stored credentials for exfiltration to be meaningful; no public exploit code was identified at time of analysis, and the flaw is an incomplete remediation of GHSA-cvpc-hccg-wmw4, whose 3.1.28 permission gate omitted this action.
Information disclosure in Formie, the Craft CMS form-building plugin from Verbb, lets any authenticated control-panel user (CVSS vector PR:L, unauthenticated exploitation is not possible) read the full contents of sent form-submission notification emails - recipient headers and complete HTML bodies containing submitted form data - by enumerating notification IDs through the formie/sent-notifications/get-resend-modal-content action. The flaw bypasses the formie-viewSentNotifications permission entirely, so accounts that were never granted permission to view sent notifications can still retrieve them; it affects releases prior to 2.2.23 in the 2.x line and prior to 3.1.31 in the 3.x line. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing, so exploitability depends on an attacker first obtaining any low-privilege Craft CMS control-panel account.
Unauthorized submission modification in Formie (Craft CMS plugin) versions prior to 2.2.21 and 3.1.26 allows remote unauthenticated attackers to overwrite existing form submissions by POSTing a known or guessed submission ID to the formie/submissions/save-submission endpoint. The flaw is an authorization bypass (CWE-639) that compromises integrity of stored submission data without requiring credentials. No public exploit identified at time of analysis, though the upstream fix and advisory are publicly disclosed on GitHub.
Formie is a Craft CMS plugin for creating forms. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Formie is a Craft CMS plugin for creating forms. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Formie is a Craft CMS plugin for creating forms. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity.