GHSA-9rg8-2wvr-fgjh: Infoleak
Impact
The control panel action formie/sent-notifications/get-resend-modal-content (SentNotificationsController::actionGetResendModalContent) performed only requireAcceptsJson() and loaded a SentNotification by request id without permission or object-level authorization checks.
Any authenticated user who could invoke the action could enumerate notification IDs and read full email content — including recipient headers and the complete HTML body containing submitted form data (PII) — without formie-accessSentNotifications or equivalent permission. Sibling actions in the same controller enforced authorization.
Patches
Fixed in 3.1.31 (Craft 5) and 2.2.23 (Craft 4).
Craft 5: canView() is enforced after loading, consistent with actionEdit. Craft 4: formie-viewSentNotifications permission is required.
Workarounds
Restrict CP access to trusted users only until upgraded. No configuration workaround.
- Reported by Jorge González (jorge@jmilla.es)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/verbb/formieto a version that resolves this vulnerability.Fixed in 2.2.23 - Upgrade
Upgrade
composer/verbb/formieto a version that resolves this vulnerability.Fixed in 3.1.31 - Upgrade
Upgrade
Formie (Craft 5)to a version that resolves this vulnerability.Fixed in 3.1.31 - Upgrade
Upgrade
Formie (Craft 4)to a version that resolves this vulnerability.Fixed in 2.2.23 - Compensating control
Restrict control panel access to trusted users only until upgrading.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user able to invoke the affected control panel action can exploit it. The action did not require the sent-notifications permission or enforce object-level authorization.
What information could be exposed?
An attacker could enumerate notification IDs and retrieve full sent-email content, including recipient headers and the complete HTML body. This may expose submitted form data and other PII.
Which releases contain the fix?
The issue is fixed in Formie 3.1.31 for Craft 5 and Formie 2.2.23 for Craft 4. The Craft 5 fix enforces canView() after loading the notification, while Craft 4 requires the formie-viewSentNotifications permission.
What can be done before upgrading?
Restrict control panel access to trusted users only. No configuration workaround is available.