Authorization Flaw in Formie Plugin for Craft CMS Exposes Sensitive Email Data
CVE-2026-76089
7.7HIGH
What is CVE-2026-76089?
The Formie plugin for Craft CMS suffers from a significant authorization flaw that permits authenticated users to exploit the formie/sent-notifications/get-resend-modal-content action. Without appropriate permissions, users can enumerate notification IDs and gain access to sensitive information, including recipient headers and entire HTML email bodies containing submitted form data. This vulnerability is fixed in versions 2.2.23 and 3.1.31, and it is crucial for all users to update to mitigate potential data exposure.
Affected Version(s)
formie < 2.2.23 < 2.2.23
formie >= 3.0.0, < 3.1.31 < 3.0.0, 3.1.31