CVE-2026-76089: Formie: Missing authorization on sent notification resend modal exposes submission PII
Impact
The control panel action formie/sent-notifications/get-resend-modal-content (SentNotificationsController::actionGetResendModalContent) performed only requireAcceptsJson() and loaded a SentNotification by request id without permission or object-level authorization checks.
Any authenticated user who could invoke the action could enumerate notification IDs and read full email content — including recipient headers and the complete HTML body containing submitted form data (PII) — without formie-accessSentNotifications or equivalent permission. Sibling actions in the same controller enforced authorization.
Patches
Fixed in 3.1.31 (Craft 5) and 2.2.23 (Craft 4).
Craft 5: canView() is enforced after loading, consistent with actionEdit. Craft 4: formie-viewSentNotifications permission is required.
Workarounds
Restrict CP access to trusted users only until upgraded. No configuration workaround.
- Reported by Jorge González (jorge@jmilla.es)
Other sources
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level authorization checks. Any authenticated user able to invoke the action can enumerate notification IDs and read recipient headers and complete HTML email bodies containing submitted form data, even without the sent-notification viewing permission. This issue is fixed in versions 2.2.23 and 3.1.31.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/verbb/formieto a version that resolves this vulnerability.Fixed in 2.2.23 - Upgrade
Upgrade
composer/verbb/formieto a version that resolves this vulnerability.Fixed in 3.1.31 - Upgrade
Upgrade
Formie for Craft 4to a version that resolves this vulnerability.Fixed in 2.2.23 - Upgrade
Upgrade
Formie for Craft 5to a version that resolves this vulnerability.Fixed in 3.1.31 - Compensating control
Restrict control panel access to trusted users only until Formie is upgraded.
Event History
Frequently Asked Questions
Which users are exposed to this issue?
Any authenticated user who can invoke the affected control panel action may be able to exploit it. The user does not need the sent-notification viewing permission.
What information could be disclosed?
An attacker can enumerate notification IDs and retrieve recipient headers and complete HTML email bodies. Those email bodies can contain submitted form data and other submission PII.
What access does an attacker need?
The attacker needs an authenticated account and the ability to invoke the affected control panel action. No user interaction is required.
Which versions contain the fix?
The issue is fixed in Formie versions 2.2.23 and 3.1.31. Versions before those releases are affected.