Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-76089

Formie: Missing authorization on sent notification resend modal exposes submission PII

CVSS 3.1 7.7 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-76089

Published

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level authorization checks. Any authenticated user able to invoke the action can enumerate notification IDs and read recipient headers and complete HTML email bodies containing submitted form data, even without the sent-notification viewing permission. This issue is fixed in versions 2.2.23 and 3.1.31.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-76089

Published

formie

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "verbb",
                    "product": "formie",
                    "versions": [
                        {
                            "version": "< 2.2.23",
                            "status": "affected"
                        },
                        {
                            "version": ">= 3.0.0, < 3.1.31",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON