| Package | Affected versions | Patched versions |
|---|---|---|
| verbb/formie | ≥ 3.0.0, < 3.1.31< 2.2.23 | 3.1.312.2.23 |
The control panel action formie/sent-notifications/get-resend-modal-content (SentNotificationsController::actionGetResendModalContent) performed only requireAcceptsJson() and loaded a SentNotification by request id without permission or object-level authorization checks.
Any authenticated user who could invoke the action could enumerate notification IDs and read full email content — including recipient headers and the complete HTML body containing submitted form data (PII) — without formie-accessSentNotifications or equivalent permission. Sibling actions in the same controller enforced authorization.
Fixed in 3.1.31 (Craft 5) and 2.2.23 (Craft 4).
Craft 5: canView() is enforced after loading, consistent with actionEdit.
Craft 4: formie-viewSentNotifications permission is required.
Restrict CP access to trusted users only until upgraded. No configuration workaround.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free