GHSA-9rg8-2wvr-fgjh: Infoleak

Published Sep 23, 2026
·
Updated

Impact

The control panel action formie/sent-notifications/get-resend-modal-content (SentNotificationsController::actionGetResendModalContent) performed only requireAcceptsJson() and loaded a SentNotification by request id without permission or object-level authorization checks.

Any authenticated user who could invoke the action could enumerate notification IDs and read full email content — including recipient headers and the complete HTML body containing submitted form data (PII) — without formie-accessSentNotifications or equivalent permission. Sibling actions in the same controller enforced authorization.

Patches

Fixed in 3.1.31 (Craft 5) and 2.2.23 (Craft 4).

Craft 5: canView() is enforced after loading, consistent with actionEdit. Craft 4: formie-viewSentNotifications permission is required.

Workarounds

Restrict CP access to trusted users only until upgraded. No configuration workaround.

- Reported by Jorge González (jorge@jmilla.es)

Affected Software

2 affected componentsFixes available
composer/verbb/formie<2.2.23
2.2.23
composer/verbb/formie>=3.0.0<3.1.31
3.1.31

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade composer/verbb/formie to a version that resolves this vulnerability.

    Fixed in 2.2.23
  2. Upgrade

    Upgrade composer/verbb/formie to a version that resolves this vulnerability.

    Fixed in 3.1.31
  3. Upgrade

    Upgrade Formie (Craft 5) to a version that resolves this vulnerability.

    Fixed in 3.1.31
  4. Upgrade

    Upgrade Formie (Craft 4) to a version that resolves this vulnerability.

    Fixed in 2.2.23
  5. Compensating control

    Restrict control panel access to trusted users only until upgrading.

Event History

Sep 23, 2026
Advisory Published
via GitHub·09:24 PM
Data Sourced
via GitHub·09:24 PM
DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

Who can exploit this issue?

Any authenticated user able to invoke the affected control panel action can exploit it. The action did not require the sent-notifications permission or enforce object-level authorization.

2

What information could be exposed?

An attacker could enumerate notification IDs and retrieve full sent-email content, including recipient headers and the complete HTML body. This may expose submitted form data and other PII.

3

Which releases contain the fix?

The issue is fixed in Formie 3.1.31 for Craft 5 and Formie 2.2.23 for Craft 4. The Craft 5 fix enforces canView() after loading the notification, while Craft 4 requires the formie-viewSentNotifications permission.

4

What can be done before upgrading?

Restrict control panel access to trusted users only. No configuration workaround is available.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203