Formie: Missing authorization on sent notification resend modal exposes submission PII
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-639.
Summary
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level authorization checks. Any authenticated user able to invoke the action can enumerate notification IDs and read recipient headers and complete HTML email bodies containing submitted form data, even without the sent-notification viewing permission. This issue is fixed in versions 2.2.23 and 3.1.31.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| verbb | formie | before 2.2.23; 3.0.0 to before 3.1.31 | 2.2.23, 3.1.31 | Patch available | CNA |
| — | verbb/formie (Packagist) | 3.0.0 to before 3.1.31 | 3.1.31 | Patch available | GHSA-9rg8-2wvr-fgjh |
| — | verbb/formie (Packagist) | before 2.2.23 | 2.2.23 | Patch available | GHSA-9rg8-2wvr-fgjh |
- formie Vendorverbb Affected before 2.2.23; 3.0.0 to before 3.1.31 Fixed in 2.2.23, 3.1.31 Patch available CNA
- verbb/formie (Packagist) Vendor— Affected 3.0.0 to before 3.1.31 Fixed in 3.1.31 Patch available GHSA-9rg8-2wvr-fgjh
- verbb/formie (Packagist) Vendor— Affected before 2.2.23 Fixed in 2.2.23 Patch available GHSA-9rg8-2wvr-fgjh
Remediation
- Fix · CNA formie (verbb) Fixed in 2.2.23, 3.1.31
- Fix · GHSA-9rg8-2wvr-fgjh verbb/formie (Packagist) Fixed in 3.1.31 Advisory →
- Fix · GHSA-9rg8-2wvr-fgjh verbb/formie (Packagist) Fixed in 2.2.23 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-76089
- 2026-10-03 Alias added: GHSA-9rg8-2wvr-fgjh
References
Other 6
- https://github.com/verbb/formie/security/advisories/GHSA-9rg8-2wvr-fgjh
- https://github.com/verbb/formie/commit/9f4e23c36b907ed7677563231eaba373fdb8b84b
- https://github.com/verbb/formie/commit/ff81a895fa91a2e4efb8d4714501ba2d92df0b76
- https://github.com/verbb/formie/releases/tag/2.2.23
- https://github.com/verbb/formie/releases/tag/3.1.31
- https://github.com/verbb/formie
More verbb vulnerabilities
- TI-2026-37985 Formie: Server-Side Template Injection in Formie Hidden field defaults CVSS 3.1CRITICAL 9.8
- TI-2026-33438 Formie: Pre-authenticated server-side template injection in Hidden fields CVSS 3.1CRITICAL 9.8
- TI-2026-34846 Formie: Unauthenticated front-end submission editing can overwrite existing submissions CVSS 4.0HIGH 8.7
- TI-2026-53255 Formie: Unauthenticated users can overwrite incomplete submissions via submit action CVSS 3.1HIGH 8.2
- TI-2020-10575 The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header. CVSS 3.1CRITICAL 9.1
- TI-2020-10552 An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. CVSS 3.1HIGH 8.8
Sources
- CVE-2026-76089 · CVE Program
- CVE-2026-76089 · NVD
- FIRST EPSS
- GHSA-9rg8-2wvr-fgjh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences