CVE-2026-76089: Formie Package Exposes PII Due to Missing Authorization on Notification Resend Modal
Summary
CVE-2026-76089: Formie: Missing authorization on sent notification resend modal exposes submission PII. Affects verbb/formie across 2 version ranges.
< 2.2.23
>= 3.0.0, < 3.1.31
Fixed in 2.2.23 or 3.1.31, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Formie is a powerful form management plugin for Craft CMS that allows users to create, manage, and analyze forms. It provides features such as form submissions, notifications, and integrations with various services. However, a vulnerability has been identified in the way it handles authorization for accessing sent notifications, potentially exposing sensitive user data.
Vulnerability Detail
The vulnerability arises from the control panel action 'formie/sent-notifications/get-resend-modal-content', which lacks proper authorization checks. Authenticated users can invoke this action to enumerate notification IDs and access full email content, including recipient headers and submitted form data (PII). This oversight allows unauthorized access to sensitive information, posing a significant risk to user privacy and data security.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.2.232.2.23composer require verbb/formie:2.2.23 -
>= 3.0.0, < 3.1.313.1.31composer require verbb/formie:3.1.31
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, restrict control panel access to trusted users only until the package is upgraded. There is no configuration workaround available to mitigate this issue.
Conclusion
The CVE-2026-76089 vulnerability in the Formie package poses a serious risk by exposing sensitive user information due to inadequate authorization checks. It is crucial to update to the latest patched versions to safeguard user data and maintain application security.
See every vulnerability recorded for verbb/formie →
FAQ
CVE-2026-76089 is a vulnerability in the Formie package that allows unauthorized access to sensitive user data due to missing authorization checks.
The vulnerability exposes personally identifiable information (PII) contained in email notifications, including recipient headers and the complete HTML body of submitted forms.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
As a temporary workaround, restrict access to the control panel to trusted users only until you can upgrade to the patched version.
The CVSS score of this vulnerability is 7.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for verbb/formie.
