CVE-2026-76089: Formie: Missing authorization on sent notification resend modal exposes submission PII
The control panel action formie/sent-notifications/get-resend-modal-content (SentNotificationsController::actionGetResendModalContent) performed only requireAcceptsJson() and loaded a SentNotification by request id without permission or object-level authorization checks.
Any authenticated user who could invoke the action could enumerate notification IDs and read full email content — including recipient headers and the complete HTML body containing submitted form data (PII) — without formie-accessSentNotifications or equivalent permission. Sibling actions in the same controller enforced authorization.
References
- github.com/advisories/GHSA-9rg8-2wvr-fgjh
- github.com/verbb/formie/commit/9f4e23c36b907ed7677563231eaba373fdb8b84b
- github.com/verbb/formie/commit/ff81a895fa91a2e4efb8d4714501ba2d92df0b76
- github.com/verbb/formie/releases/tag/2.2.23
- github.com/verbb/formie/releases/tag/3.1.31
- github.com/verbb/formie/security/advisories/GHSA-9rg8-2wvr-fgjh
- nvd.nist.gov/vuln/detail/CVE-2026-76089
Code Behaviors & Features
Detect and mitigate CVE-2026-76089 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →