{"action":"Upgrade verbb/formie to 2.2.23 or later.","affected":[{"fixed":"3.1.31","introduced":"3.0.0"},{"fixed":"2.2.23","introduced":"0"}],"component":"verbb/formie","cve_ids":["CVE-2026-76086"],"ecosystem":"Packagist","epss":0.0051,"exploited":false,"fixed_versions":["3.1.31","2.2.23"],"ghsa_id":"GHSA-v3f3-cmj4-cvj9","id":"tcs_01M5KF8QS6MSK6T0QE50XA6EPM","modified_at":"2026-09-24T03:56:44.692828998Z","published_at":"2026-09-23T18:33:57Z","references":["https://osv.dev/vulnerability/GHSA-v3f3-cmj4-cvj9","https://github.com/verbb/formie/security/advisories/GHSA-v3f3-cmj4-cvj9","https://github.com/verbb/formie/commit/6735fe4ae8f6a2a76930716ad7876b236f7c530d","https://github.com/verbb/formie/commit/dde7799dfa7e4d0a11e28754ad8544dba62d5def","https://github.com/advisories/GHSA-cvpc-hccg-wmw4","https://github.com/verbb/formie","https://github.com/verbb/formie/releases/tag/2.2.23","https://github.com/verbb/formie/releases/tag/3.1.31"],"severity":{"label":"high","score":8.5},"sources":[{"source":"osv","source_id":"GHSA-v3f3-cmj4-cvj9","url":"https://osv.dev/vulnerability/GHSA-v3f3-cmj4-cvj9"}],"summary":"Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials"}