GHSA-9rg8-2wvr-fgjh Formie: Missing authorization on sent notification resend modal exposes submission PII

• Packagist verbb/formie: >= 3.0.0, < 3.1.31 → fixed in 3.1.31 • Packagist verbb/formie: < 2.2.23 → fixed in 2.2.23

Impact The control panel action `formie/sent-notifications/get-resend-modal-content` (`SentNotificationsController::actionGetResendModalContent`) performed only `requireAcceptsJson()` and loaded a `SentNotification` by request `id` without permission or object-level authorization checks. Any authenticated user who could invoke the action could enumerate notification IDs and read full email content — including recipient headers and the complete HTML body containing submitted form data (PII) — without `formie-accessSentNotifications` or equivalent permission. Sibling actions in the same controller enforced authorization. Patches Fixed in 3.1.31 (Craft 5) and 2.2.23 (Craft 4). Craft 5: `canView()` is enforced after loading, consistent with `actionEdit`. Craft 4: `formie-viewSentNotifications` permission is required. Workarounds Restrict CP access to trusted users only until upgraded. No configuration workaround. • Reported by Jorge González ([email protected])