Formie, a Craft CMS form plugin, has a flaw where the sent‑notifications/get‑resend‑modal‑content action does not enforce permission or object‑level authorization. Any authenticated user can supply a notification ID, fetch recipient headers, and read the full email body that contains the submitted form data, exposing personally identifiable information. The weakness is a combination of data exposure, missing authorization, and improper access control.

The vulnerability exists in the Formie plugin from the vendor verbb for all releases before 2.2.23 and before 3.1.31. Users deployed with these versions of Formie on Craft CMS are susceptible.

The CVSS score of 7.7 indicates a high impact and medium to high exploitation likelihood. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated to the Craft CMS control panel; they can invoke the unwarned action, enumerate notification identifiers, and retrieve form data. No external access or privilege escalation is required beyond general user authentication. The nature of the attack vector relies on insufficient authorization checks.