Formie EUVD-2026-85538

Exploitation requires an authenticated Craft CMS control-panel account of any privilege level - the flaw specifically bypasses the formie-viewSentNotifications permission, so even users WITHOUT that permission succeed. The vulnerable path is the formie/sent-notifications/get-resend-modal-content action (SentNotificationsController::actionGetResendModalContent), which before the patch performed neither a permission check nor an object-level ownership check on the request-supplied notification ID. No special non-default configuration is needed beyond having the Formie plugin installed with sent notifications present; the limiting factor is solely the requirement for a valid authenticated (low-privilege) session, and exploitation ends at information disclosure with no integrity or availability effect.

This is a genuine, easily-triggered access-control flaw but a moderate real-world priority. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N = 7.7) is confirmed and consistent with the description: a network-reachable control-panel action reachable by any low-privileged authenticated Craft CMS user, with no user interaction and low complexity. The single mitigating factor is PR:L - an attacker needs a valid authenticated account in the Craft control panel, which limits opportunistic mass exploitation. No EPSS score, no CISA KEV listing, and no SSVC decision data are provided, and no public exploit is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vendor's S:C (scope change) rating is defensible if the disclosed form-submission data is considered to belong to a different security authority (form submitters) than the CP user, but it is arguable; treating it as S:U would yield ~6.5. The confidentiality impact (C:H) is credible because full HTML email bodies and recipient headers containing arbitrary submitted form data are exposed. Net: a real, verified authorization bug worth patching promptly in affected Formie installs, but not an emergency given the authentication prerequisite and absence of exploitation signals.

A low-privileged authenticated Craft CMS user (e.g. a limited content editor) who lacks the sent-notification viewing permission invokes the formie/sent-notifications/get-resend-modal-content control-panel action, supplying arbitrary notification IDs. By enumerating sequential IDs they harvest recipient email headers and complete HTML email bodies containing other users' submitted form data. No public exploit code is referenced, but the fix commit clearly reveals the missing permission and object-existence checks.