GHSA-CVPC-HCCG-WMW4: Missing Authorization in Formie Administrative Settings Allows Privilege Escalation
Vulnerability ID: GHSA-CVPC-HCCG-WMW4
CVSS Score: 8.8
Published: 2026-07-17
A missing authorization vulnerability in the Formie plugin for Craft CMS prior to version 3.1.28 allows low-privileged Control Panel users to read and modify sensitive administrative settings, configuration options, and third-party integrations.
TL;DR
Low-privileged Craft CMS Control Panel users can bypass UI restrictions and make direct HTTP requests to Formie controller endpoints to modify administrative settings and access API keys due to missing server-side authorization checks.
Technical Details
- CWE ID: CWE-862 (Missing Authorization)
- Attack Vector: Network
- CVSS v3.1: 8.8 (High)
- EPSS Score: N/A
- Impact: Privilege Escalation and Unauthorized Configuration Modification
- Exploit Status: No public exploit available
- KEV Status: Not listed
Affected Systems
- Formie plugin for Craft CMS
-
Formie: < 3.1.28 (Fixed in:
3.1.28)
Mitigation Strategies
- Apply official patch by upgrading Formie to version 3.1.28 or higher.
- Audit Craft CMS user group permissions to ensure only trusted administrators possess the newly introduced 'formie-accessSettings' permission.
- Configure Web Application Firewall (WAF) rules to restrict access to administrative endpoints from non-admin sessions.
Remediation Steps:
- Log in to the Craft CMS administrative control panel.
- Navigate to the Plugin Store or Updates section.
- Select Formie and execute the upgrade to version 3.1.28 or later.
- Review the User Permissions control panel to verify user roles are restricted.
- Clear application and routing caches using the craft clear-caches command.
References
Read the full report for GHSA-CVPC-HCCG-WMW4 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)