Formie, a Craft CMS plugin for creating forms, had a missing authorization vulnerability (CWE-862) in the formie/integrations/form-settings action within IntegrationsController::actionFormSettings. Prior to versions 2.2.23 and 3.1.31, this action was accessible without required form integration permissions. An authenticated attacker could supply request parameters to replace outbound host properties such as apiUrl, causing the server to make non-blind server-side requests using stored API keys or OAuth tokens to attacker-controlled or internal hosts. This could lead to exposure of integration credentials and internal network responses. The flaw persisted because the permission gate added in version 3.1.28 excluded the form-settings action. The vulnerability is fixed in versions 2.2.23 and 3.1.31.

An authenticated attacker with low privileges can exploit this vulnerability to manipulate integration settings, causing the server to make requests to attacker-controlled or internal hosts using stored API keys or OAuth tokens. This can lead to exposure of sensitive integration credentials and internal network responses, potentially compromising confidentiality and integrity of data. The CVSS 3.1 score is 8.5 (high severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact.

This vulnerability is fixed in Formie versions 2.2.23 and 3.1.31. Users should upgrade to these versions or later to ensure proper authorization checks are enforced on the form-settings action. No additional mitigation is required once patched.