CVE-2026-76089: 
PHP 취약성 분석 및 완화

CVE-2026-76089 is a missing authorization vulnerability in Formie, a Craft CMS plugin for creating forms developed by verbb. The flaw allows any authenticated Craft CMS control panel user to enumerate sent notification IDs and read full email content — including recipient headers and HTML email bodies containing submitted form data (PII) — without requiring the formie-accessSentNotifications or equivalent permission. Affected versions are Formie < 2.2.23 (Craft 4) and >= 3.0.0, < 3.1.31 (Craft 5). The vulnerability was disclosed on September 23, 2026, and carries a CVSS v3.1 base score of 7.7 (High) (GitHub Advisory).

The root cause is a missing object-level authorization check (CWE-862, CWE-639) in the SentNotificationsController::actionGetResendModalContent action, reachable via the control panel route formie/sent-notifications/get-resend-modal-content. The action only called requireAcceptsJson() before loading a SentNotification record by a caller-supplied id parameter, with no permission gate or ownership verification — a classic Insecure Direct Object Reference (IDOR) pattern. Sibling actions in the same controller correctly enforced authorization, making this an isolated oversight. The fix for Craft 4 (commit 9f4e23c) adds $this->requirePermission('formie-viewSentNotifications'), while the Craft 5 fix (commit ff81a89) enforces $sentNotification->canView($currentUser) after loading the record (GitHub Advisory, Craft 4 Commit, Craft 5 Commit).

Successful exploitation allows any authenticated control panel user — regardless of their assigned Formie permissions — to enumerate all sent notification IDs and retrieve the full HTML email body and recipient headers for each notification, exposing personally identifiable information (PII) submitted through site forms (e.g., names, email addresses, phone numbers, and other user-supplied data). The confidentiality impact is rated High with a changed scope, meaning data from across the entire Formie notification store is accessible, not just the attacker's own records. There is no integrity or availability impact, and exploitation does not directly enable lateral movement or code execution (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid authenticated session in the Craft CMS control panel, limiting the attack surface to users who already have some level of CP access. The NVD SSVC assessment classifies exploitation as "none" and technical impact as "partial" (GitHub Advisory, Feedly).

1. Obtain CP access: Log in to the Craft CMS control panel with any authenticated user account, even one with minimal permissions (no Formie-specific permissions required).
2. Identify the vulnerable endpoint: Target the control panel action at formie/sent-notifications/get-resend-modal-content, which accepts a JSON request with a notification id parameter.
3. Enumerate notification IDs: Send sequential or range-based GET/POST requests to the endpoint with incrementing integer id values (e.g., ?id=1, ?id=2, ...) using a tool such as curl, Burp Suite Intruder, or a custom script, including the Accept: application/json header to satisfy requireAcceptsJson().
4. Extract sensitive data: For each valid notification ID, the server returns the rendered resend modal HTML, which includes the full email body (containing submitted form data/PII) and recipient headers.
5. Harvest PII: Parse the returned HTML responses to extract names, email addresses, phone numbers, and any other data submitted through Formie forms (GitHub Advisory, Craft 4 Commit).

• Network: Repeated HTTP requests to the Craft CMS control panel endpoint formie/sent-notifications/get-resend-modal-content with sequentially or randomly varying id parameter values from a single authenticated session; requests include Accept: application/json header.
• Logs: Craft CMS web/access logs showing a high volume of requests to the sent-notifications/get-resend-modal-content action from a single user account or IP address in a short time window, especially from accounts not expected to access sent notifications.
• Logs: Absence of 403/permission-denied responses for users without formie-viewSentNotifications permission on unpatched versions (all requests return 200 with modal HTML).

Upgrade Formie to version 2.2.23 (Craft 4) or 3.1.31 (Craft 5) or later, which add proper authorization checks to the vulnerable action. As an interim workaround, restrict Craft CMS control panel access to trusted administrators only, minimizing the pool of users who could invoke the action. There is no configuration-level workaround that fully mitigates the vulnerability without upgrading (GitHub Advisory, Release 2.2.23, Release 3.1.31).

The vulnerability was reported by security researcher Jorge González (jorge@jmilla.es) and credited in the GitHub Security Advisory. No notable public commentary, media coverage, or significant social media discussion has been identified beyond the advisory publication (GitHub Advisory).