Formie, a Craft CMS form plugin, exposes its form‑settings control panel action to users without proper permissions. An attacker who can authenticate, even at low privilege, may change outbound parameters such as apiUrl while the server still uses stored API keys or OAuth tokens. The server then makes a non‑blind request to the attacker‑controlled or internal host and returns that response, leaking integration credentials and other internal data to the attacker. This flaw embodies missing authorization (CWE‑862), improper handling of assets (CWE‑915), and server‑side request forgery (CWE‑918).

Any Craft CMS site running verbb:formie version 2.x before 2.2.23 or 3.x before 3.1.31 is affected. The vulnerability exists specifically in the actionFormSettings route of IntegrationsController, which can be accessed through the control‑panel interface by authenticated users lacking the required integration permissions.

The CVSS score of 8.5 classifies this flaw as high severity. Although the EPSS score is currently unavailable, advisories and public commits demonstrate that the issue can be actively exploited. The flaw is not listed in the CISA KEV catalog, but it remains a high‑risk vector for credential theft and internal network reconnaissance. An attacker needs only authenticated access and the ability to reach the control‑panel route; no remote exploit code is required beyond sending a crafted form‑settings request.