CVE-2026-76089: Formie Craft CMS Information Disclosure

CVE-2026-76089 Overview

CVE-2026-76089 is a missing authorization vulnerability [CWE-200] in Formie, a form-building plugin for Craft CMS developed by Verbb. The formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level authorization checks. Any authenticated user able to invoke the action can enumerate notification IDs and read recipient headers and complete HTML email bodies containing submitted form data. Exploitation succeeds even when the caller lacks the sent-notification viewing permission. The issue is fixed in Formie versions 2.2.23 and 3.1.31.

Critical Impact
Authenticated low-privilege users can read arbitrary sent-notification content, exposing recipient data and previously submitted form fields.

Affected Products

Verbb Formie plugin for Craft CMS versions prior to 2.2.23
Verbb Formie plugin for Craft CMS versions in the 3.x line prior to 3.1.31
Craft CMS installations exposing the Formie control panel to authenticated users

Discovery Timeline

2026-09-23 - CVE-2026-76089 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-76089

Vulnerability Analysis

The vulnerability resides in SentNotificationsController::actionGetResendModalContent within src/controllers/SentNotificationsController.php. The action loads a SentNotification record using an id parameter taken directly from the HTTP request. The controller then renders the formie/sent-notifications/_includes/resend-modal template using that record without validating whether the current user is permitted to view the notification.

Because Craft CMS control panel routes require authentication but not necessarily fine-grained permissions, any signed-in user with control panel access can iterate through notification IDs. The response contains the full rendered modal, including recipient email headers and the HTML body of the sent notification. Submitted form data embedded in the notification body is therefore exposed to unauthorized users.

Root Cause

The controller omitted both role-based permission checks and object-level authorization. Craft's Element::canView() API is available on SentNotification records but was not invoked prior to rendering. The absence of this call is the root cause of the information disclosure.

Attack Vector

An attacker authenticates to the Craft CMS control panel using any account with access to the Formie module. The attacker then issues requests to formie/sent-notifications/get-resend-modal-content with sequential or guessed id values. Each successful response returns the full modal HTML for the corresponding notification, disclosing the recipient and submitted form content.

php

// Patch applied in SentNotificationsController::actionGetResendModalContent
$request = $this->request;
$view = $this->getView();
$currentUser = Craft::$app->getUser()->getIdentity();

$sentNotification = SentNotification::find()
    ->id($request->getParam('id'))
    ->one();

if (!$sentNotification || !$sentNotification->canView($currentUser)) {
    throw new ForbiddenHttpException('User is not permitted to perform this action');
}

$modalHtml = $view->renderTemplate('formie/sent-notifications/_includes/resend-modal', [
    'sentNotification' => $sentNotification,
]);

Source: GitHub Commit ff81a89. The patch introduces the missing canView() check and throws ForbiddenHttpException when the user lacks authorization.

Detection Methods for CVE-2026-76089

Indicators of Compromise

Repeated HTTP requests to /admin/actions/formie/sent-notifications/get-resend-modal-content from a single authenticated session
Sequential or numeric enumeration patterns in the id query parameter for the resend modal action
Control panel activity from user accounts that lack the sent-notification viewing permission but still receive successful 200 responses from the endpoint

Detection Strategies

Review Craft CMS web server logs for high request volumes to the formie/sent-notifications/get-resend-modal-content route grouped by user or IP
Correlate authenticated user IDs with their assigned Formie permissions to identify calls made without the sent-notification viewing right
Alert on unusual response sizes from the resend modal endpoint, which indicate successful rendering of notification content

Monitoring Recommendations

Enable Craft CMS audit logging for control panel actions and forward events to a central log store
Baseline normal Formie administrator activity and flag deviations in access to the sent-notifications area
Track responses from the affected endpoint that return HTML payloads to low-privilege accounts

How to Mitigate CVE-2026-76089

Immediate Actions Required

Upgrade Formie to version 2.2.23 for 2.x deployments or 3.1.31 for 3.x deployments
Audit all Craft CMS user accounts with control panel access and remove unnecessary Formie permissions
Review historical access logs for the formie/sent-notifications/get-resend-modal-content endpoint to identify potential unauthorized reads

Patch Information

The fix is delivered in Formie Release 2.2.23 and Formie Release 3.1.31. The corrective changes are implemented in GitHub Commit 9f4e23c and GitHub Commit ff81a89. Additional context is available in the GitHub Security Advisory GHSA-9rg8-2wvr-fgjh.

Workarounds

Restrict control panel access to trusted administrators until the patched version is deployed
Block requests to the formie/sent-notifications/get-resend-modal-content action at a web application firewall for accounts outside the Formie administrator group
Purge or archive historical sent-notification records that are no longer required, reducing the data exposed if the endpoint is abused

bash

# Update Formie via Composer to a patched release
composer require verbb/formie:^3.1.31
# For 2.x branch installations
composer require verbb/formie:^2.2.23
php craft migrate/all
php craft clear-caches/all