CVE-2026-76089

Name of the Vulnerable Software and Affected Versions Formie versions prior to 2.2.23 Formie versions prior to 3.1.31

Description An authenticated user can enumerate notification IDs and read recipient headers and complete HTML email bodies containing submitted form data. This occurs because the control panel action 'formie/sent-notifications/get-resend-modal-content' in the SentNotificationsController::actionGetResendModalContent function accepts a request-supplied id without performing permission or object-level authorization checks.

Recommendations Update Formie to version 2.2.23 or newer. Update Formie to version 3.1.31 or newer. Restrict control panel access to trusted users only.