CVE-2026-76089High· 7.7▾ TwilightFormie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-s…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level authorization checks. Any authenticated user able to invoke the action can enumerate notification IDs and read recipient headers and complete HTML email bodies containing submitted form data, even without the sent-notification viewing permission. This issue is fixed in versions 2.2.23 and 3.1.31.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
verbb/formie >= 3.0.0, < 3.1.31verbb/formie < 2.2.23Patched in:
verbb/formie 3.1.31verbb/formie 2.2.23Connected by shared product, vendor, weakness, or advisory.
CVE-2026-76087High· 8.2Formie is a Craft CMS plugin for creating forms
CVE-2026-76086High· 8.5Formie is a Craft CMS plugin for creating forms
GHSA-cvpc-hccg-wmw4Medium· 6.3Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration
CVE-2026-45330Medium· 4.9Decidim is a participatory democracy framework
CVE-2026-50025Medium· 6.9Mousehole is a background service to update a seedbox IP for MAM and web app to manage it
CVE-2026-47351MediumTYPO3 CMS: Broken Access Control in Media Module