CVE-2026-76089
Received Received - Intake

Information Disclosure in Formie Craft CMS Plugin

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level authorization checks. Any authenticated user able to invoke the action can enumerate notification IDs and read recipient headers and complete HTML email bodies containing submitted form data, even without the sent-notification viewing permission. This issue is fixed in versions 2.2.23 and 3.1.31.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-76089
EUVD
EUVD-2026-85538

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
formie formie to 2.2.23 (inc)
formie formie to 3.1.31 (inc)
verbb formie 2.2.23
verbb formie 3.1.31

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authorization check in the Formie plugin for Craft CMS. It affects the formie/sent-notifications/get-resend-modal-content action, which allows any authenticated user to access notification IDs and read recipient headers and email bodies containing submitted form data without proper permissions.

Detection Guidance

This vulnerability can be detected by checking the Formie plugin version installed on your Craft CMS system. If you are running a version prior to 2.2.23 (Craft 4) or 3.1.31 (Craft 5), the system is vulnerable. Review access logs for unauthorized attempts to access the formie/sent-notifications/get-resend-modal-content endpoint.

Impact Analysis

An attacker could exploit this to access sensitive data like recipient emails and form submissions, including personally identifiable information. This could lead to data breaches or unauthorized access to confidential information.

Compliance Impact

This vulnerability could violate GDPR and HIPAA by exposing personal data without authorization. GDPR requires strict data access controls, and HIPAA mandates safeguards for protected health information. Non-compliance risks legal penalties and reputational damage.

Mitigation Strategies

Immediately upgrade the Formie plugin to version 2.2.23 or later for Craft 4, or 3.1.31 or later for Craft 5. If upgrading is not possible, restrict control panel access to trusted users only until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76089. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart