verbb/formie Security Advisories | GitStock

high2026-09-23

Formie: Missing authorization on sent notification resend modal exposes submission PII

GHSA-9rg8-2wvr-fgjh · CVE-2026-76089

high2026-09-23

Formie: Unauthenticated users can overwrite incomplete submissions via submit action

GHSA-584p-f93j-wpgc · CVE-2026-76087

high2026-09-23

Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

GHSA-v3f3-cmj4-cvj9 · CVE-2026-76086

medium2026-07-17

Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration

GHSA-cvpc-hccg-wmw4

critical2026-07-06

Formie Hidden field defaults vulnerable to Server-Side Template Injection

GHSA-565m-g33j-jq96 · CVE-2026-52889

high2026-05-29

formie's unauthenticated front-end submission editing can overwrite existing submissions

GHSA-pgxq-p76c-x9cg · CVE-2026-47266

critical2026-05-18

Formie: Pre-authenticated server-side template injection in Hidden fields

GHSA-x7m9-mwc2-g6w2 · CVE-2026-45697

medium2025-04-11

Formie has XSS vulnerability for email notification content for preview

GHSA-2xm2-23ff-p8ww · CVE-2025-32426

medium2025-04-11

Formie has XSS vulnerability for importing forms

GHSA-p9hh-mh5x-wvx3 · CVE-2025-32427

medium2024-05-20

verbb/formie Server-Side Template Injection for variable-enabled settings

GHSA-v45m-hxqp-fwf5 · CVE-2024-35191