{"id":"CVE-2026-76089","aliases":["GHSA-9rg8-2wvr-fgjh"],"url":"https://o3.security/vulnerability/CVE-2026-76089","summary":"Formie: Missing authorization on sent notification resend modal exposes submission PII","details":"### Impact\n\nThe control panel action `formie/sent-notifications/get-resend-modal-content` (`SentNotificationsController::actionGetResendModalContent`) performed only `requireAcceptsJson()` and loaded a `SentNotification` by request `id` without permission or object-level authorization checks.\n\nAny authenticated user who could invoke the action could enumerate notification IDs and read full email content — including recipient headers and the complete HTML body containing submitted form data (PII) — without `formie-accessSentNotifications` or equivalent permission. Sibling actions in the same controller enforced authorization.\n\n### Patches\n\nFixed in **3.1.31** (Craft 5) and **2.2.23** (Craft 4).\n\nCraft 5: `canView()` is enforced after loading, consistent with `actionEdit`.  \nCraft 4: `formie-viewSentNotifications` permission is required.\n\n### Workarounds\n\nRestrict CP access to trusted users only until upgraded. No configuration workaround.\n\n- Reported by Jorge González (jorge@jmilla.es)","published":"2026-09-23T18:25:23.245Z","modified":"2026-10-21T02:59:40.359513826Z","cvss":{"score":7.7,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"verbb/formie","fixedVersion":"3.1.31"},{"ecosystem":"Packagist","name":"verbb/formie","fixedVersion":"2.2.23"}],"fix":{"url":"https://github.com/verbb/formie/commit/9f4e23c36b907ed7677563231eaba373fdb8b84b","label":"verbb/formie@9f4e23c"},"references":[{"type":"WEB","url":"https://github.com/verbb/formie/releases/tag/2.2.23"},{"type":"WEB","url":"https://github.com/verbb/formie/releases/tag/3.1.31"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76089.json"},{"type":"ADVISORY","url":"https://github.com/verbb/formie/security/advisories/GHSA-9rg8-2wvr-fgjh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76089"},{"type":"FIX","url":"https://github.com/verbb/formie/commit/9f4e23c36b907ed7677563231eaba373fdb8b84b"},{"type":"FIX","url":"https://github.com/verbb/formie/commit/ff81a895fa91a2e4efb8d4714501ba2d92df0b76"},{"type":"PACKAGE","url":"https://github.com/verbb/formie"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:59:40.359513826Z"}}