Listen to this Post
Formie control panel action formie/sent-notifications/get-resend-modal-content is vulnerable.
The action maps to SentNotificationsController::actionGetResendModalContent.
It only calls requireAcceptsJson().
It does not enforce permission checks.
It does not enforce object-level authorization.
It loads a SentNotification by request id.
The id is user-controlled.
Any authenticated user who can invoke the action can enumerate notification IDs.
They can read full email content.
That includes recipient headers.
It includes the complete HTML body.
The body contains submitted form data.
That data can contain PII.
The required permission would be formie-accessSentNotifications.
Sibling actions in the same controller enforce authorization.
The missing check is inconsistent.
Craft 5 fix is 3.1.31.
Craft 4 fix is 2.2.23.
Craft 5 enforces canView() after loading.
That matches actionEdit.
Craft 4 requires formie-viewSentNotifications.
No configuration workaround exists.
Restrict CP access to trusted users until upgraded.
Affected Craft 5 is >=3.0.0, <3.1.31.
Affected Craft 4 is <2.2.23.
Patched Craft 5 is 3.1.31.
Patched Craft 4 is 2.2.23.
Severity is high.
GitHub Reviewed advisory.
Published Jul 9, 2026.
Updated Sep 23, 2026.
DailyCVE Form:
Platform: Formie
Version: >=3.0.0 <3.1.31 <2.2.23
Vulnerability : Missing authorization PII
Severity: High
date: Jul 9 2026
Prediction: 2026-09-23
(end of form)
What Undercode Say:
Analytics:
composer show verbb/formie composer show verbb/formie --all | grep -E '3.1.31|2.2.23' grep -R "actionGetResendModalContent" vendor/verbb/formie/src grep -R "requireAcceptsJson" vendor/verbb/formie/src/controllers/SentNotificationsController.php grep -R "formie-accessSentNotifications|formie-viewSentNotifications|canView" vendor/verbb/formie/src
Exploit: (Educational Purposes!)
Educational only. Replace placeholders. Authorized targets only. curl -s -X POST 'https://TARGET/index.php?action=formie/sent-notifications/get-resend-modal-content' \ -H 'Accept: application/json' \ -H 'X-CSRF-Token: CSRF_TOKEN' \ --data 'id=1'
// Vulnerable pattern
$this->requireAcceptsJson();
$id = Craft::$app->request->getRequiredBodyParam('id');
$notification = SentNotification::find()->id($id)->one();
return $this->asJson(['html' => $notification->body, 'headers' => $notification->recipients]);
Protection: from this CVE
composer require verbb/formie:^3.1.31 composer require verbb/formie:^2.2.23
// Craft 5 fix pattern
if (!$notification->canView()) {
throw new ForbiddenHttpException();
}
// Craft 4 fix pattern
if (!Craft::$app->getUser()->checkPermission('formie-viewSentNotifications')) {
throw new ForbiddenHttpException();
}
Impact:
Any authenticated CP user can enumerate notification IDs and read full email content including recipient headers and complete HTML body containing submitted form data (PII) without formie-accessSentNotifications or equivalent permission.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
