- Package
- verbb/formie
- Fixed in
- 3.1.31, 2.2.23
- Published
- Wed 23 Sep 2026, 22:24 LisbonUpdated Mon 26 Oct 2026, 01:25 Lisbon
- Installs on Packagist
- 427K
In plain words
An authenticated user who can invoke Formie's sent notification resend modal action can read full notification emails without the required permissions. This exposes recipient headers and the complete HTML body, including personal information submitted through forms.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| verbb/formie | >= 3.0.0, < 3.1.31 | 3.1.31 |
| verbb/formie | < 2.2.23 | 2.2.23 |
Am I affected?
Check composer.lock for verbb/formie: versions below 2.2.23, or from 3.0.0 up to but not including 3.1.31, are affected. Check whether authenticated users can invoke formie/sent-notifications/get-resend-modal-content through the control panel. Lacking formie-accessSentNotifications or equivalent permission does not prevent access on affected versions. Fixed versions are 2.2.23 for Craft 4 and 3.1.31 for Craft 5.
What to do
Check which version you have, then update to a fixed release for your branch (3.1.31, 2.2.23):
composer show verbb/formie | grep versions
composer update verbb/formieIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
Restrict control panel access to trusted users only until upgraded. There is no configuration workaround.
The advisory's description
Impact
The control panel action formie/sent-notifications/get-resend-modal-content (SentNotificationsController::actionGetResendModalContent) performed only requireAcceptsJson() and loaded a SentNotification by request id without permission or object-level authorization checks.
Any authenticated user who could invoke the action could enumerate notification IDs and read full email content — including recipient headers and the complete HTML body containing submitted form data (PII) — without formie-accessSentNotifications or equivalent permission. Sibling actions in the same controller enforced authorization.
Patches
Fixed in 3.1.31 (Craft 5) and 2.2.23 (Craft 4).
Craft 5: canView() is enforced after loading, consistent with actionEdit.
Craft 4: formie-viewSentNotifications permission is required.
Workarounds
Restrict CP access to trusted users only until upgraded. No configuration workaround.
- Reported by Jorge González (jorge@jmilla.es)
Weakness: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor; CWE-639 Authorization Bypass Through User-Controlled Key; CWE-862 Missing Authorization. Reported by Pig-Tail.
The advisory
- GitHub Advisory Database: GHSA-9rg8-2wvr-fgjh, with who is affected and how
- OSV.dev: GHSA-9rg8-2wvr-fgjh
- The week's digest, with the other advisories from 21 Sep 2026
- All advisories for verbb/formie