CVE-2026-76089 in Formie Plugin
Summary
by MITRE • 09/23/2026
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level authorization checks. Any authenticated user able to invoke the action can enumerate notification IDs and read recipient headers and complete HTML email bodies containing submitted form data, even without the sent-notification viewing permission. This issue is fixed in versions 2.2.23 and 3.1.31.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified within the Formie plugin for Craft CMS represents a critical failure in access control mechanisms, specifically categorized under CWE-862 Missing Authorization. In its vulnerable states prior to version 2.2.23 and 3.1.31, the component responsible for handling resend notification requests, formally known as formie/sent-notifications/get-resend-modal-content within the SentNotificationsController class, failed to enforce proper permission checks or object-level authorization before processing incoming requests. This architectural flaw allows any authenticated user who possesses the basic ability to invoke this specific control panel action to bypass intended security boundaries. The core technical issue lies in the controller's acceptance of a request-supplied notification identifier without validating whether the requesting user has the requisite privileges associated with that specific resource or general access rights for sent notifications.
From an operational perspective, this lack of authorization enforcement enables unauthorized enumeration and data exfiltration. An attacker can systematically iterate through potential notification identifiers to discover valid entries within the system's database. Once a valid identifier is found, the vulnerability allows the retrieval of sensitive information associated with that specific form submission. This includes recipient email headers and the complete HTML body of the sent emails. Since Formie plugins are typically used to collect user-submitted data from websites, these email bodies often contain personally identifiable information (PII), contact details, or other confidential data provided by end-users during form completion. The ability to read this content without explicit permission constitutes a significant breach of confidentiality and privacy standards.
This vulnerability aligns with the MITRE ATT&CK framework technique T1078 Valid Accounts, as it leverages existing authenticated credentials to access restricted resources. Furthermore, it reflects aspects of data exposure where sensitive information is accessible due to improper configuration or implementation errors in access control logic. The impact extends beyond simple data leakage; it undermines trust in the web application's security posture and may lead to regulatory non-compliance depending on the nature of the exposed data and applicable laws such as GDPR or CCPA.
To mitigate this risk, organizations using Formie must upgrade immediately to version 2.2.23 for Craft CMS 4.x installations or version 3.1.31 for earlier versions. These releases include patches that enforce proper authorization checks on the get-resend-modal-content action, ensuring that only users with explicit sent-notification viewing permissions can access sensitive email data. Administrators should also review their user role configurations to ensure that least privilege principles are applied strictly within the Craft CMS control panel, limiting access to administrative functions and sensitive data retrieval actions to authorized personnel only. Regular security audits of custom plugins and third-party extensions are recommended to detect similar authorization flaws in other components before they can be exploited.