A high-severity authorization bypass in the Formie plugin for Craft CMS allows authenticated attackers to perform server-side request forgery and expose sensitive integration credentials.

This vulnerability involves missing authorization checks and improper modification of object attributes within the IntegrationsController. An authenticated attacker can trigger unauthorized server-side requests to internal or external hosts, potentially leaking stored API keys or OAuth tokens.

The vulnerability carries a CVSS score of 8.5, reflecting a significant risk to data confidentiality and system integrity. Successful exploitation could allow an attacker to exfiltrate sensitive credentials used for third-party integrations, facilitate internal network scanning, or conduct further attacks against internal services that are not exposed to the public internet.

Immediate Action: Update the Formie plugin to version 2.2.23 or 3.1.31 immediately to implement the required permission gates.

Proactive Monitoring: Review web server and application logs for unusual outbound requests originating from the Formie plugin or unexpected access to the IntegrationsController.

Compensating Controls: Implement strict egress filtering on the web server to prevent unauthorized connections to internal resources or suspicious external domains.

Public Exploit Available: Unknown

Given the severity of this flaw and the potential for credential theft, administrators should prioritize updating the Formie plugin across all Craft CMS environments. Failure to patch allows attackers with even low-level authentication to leverage the server as a proxy, which could lead to a full compromise of integrated service accounts and internal network exposure.