High severity · published Sep 23, 2026
CVE-2026-76089
Formie: Missing authorization on sent notification resend modal exposes submission PII
7.7
CVSS
0.4%
EPSS
No
On KEV
Description
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level authorization checks. Any authenticated user able to invoke the action can enumerate notification IDs and read recipient headers and complete HTML email bodies containing submitted form data, even without the sent-notification viewing permission. This issue is fixed in versions 2.2.23 and 3.1.31.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
formie · verbb
< 2.2.23; >= 3.0.0, < 3.1.31 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-76089
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-76089
github.com
https://github.com/verbb/formie/commit/9f4e23c36b907ed7677563231eaba373fdb8b84b
github.com
https://github.com/verbb/formie/commit/ff81a895fa91a2e4efb8d4714501ba2d92df0b76
github.com
https://github.com/verbb/formie/releases/tag/2.2.23
github.com
https://github.com/verbb/formie/releases/tag/3.1.31
github.com
https://github.com/verbb/formie/security/advisories/GHSA-9rg8-2wvr-fgjh
More from formie
9.8
CVE-2026-52889
Formie: Server-Side Template Injection in Formie Hidden field defaults
9.8
CVE-2026-45697
Formie: Pre-authenticated server-side template injection in Hidden fields
8.7
CVE-2026-47266
Formie: Unauthenticated front-end submission editing can overwrite existing submissions
8.5
CVE-2026-76086
Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials
8.2
CVE-2026-76087
Formie: Unauthenticated users can overwrite incomplete submissions via submit action