Formie versions prior to 2.2.23 and 3.1.31 contain an authorization bypass vulnerability in the control panel action SentNotificationsController::actionGetResendModalContent. The action accepts a request-supplied notification ID without verifying permissions or object-level authorization. As a result, any authenticated user able to invoke this action can enumerate notification IDs and retrieve sensitive information including recipient headers and complete HTML email bodies with submitted form data, even if they lack the sent-notification viewing permission. The vulnerability is addressed in versions 2.2.23 and 3.1.31.

An authenticated user can access sensitive information such as recipient headers and full HTML email bodies containing submitted form data without proper authorization. This exposure could lead to leakage of confidential user-submitted data. The vulnerability does not affect confidentiality of the system beyond the exposed notification data and does not impact integrity or availability.

Upgrade Formie to version 2.2.23 or later in the 2.x series, or to version 3.1.31 or later in the 3.x series to apply the official fix that enforces proper permission and object-level authorization checks on the get-resend-modal-content action.