CVE-2026-76089 Formie: Missing authorization on sent notification resend modal exposes submission PII

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level...

EUVD-2026-85538

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level...

CVE-2026-76089 Formie: Missing authorization on sent notification resend modal exposes submission PII

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level...

CVE-2026-73858

Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in...

Solspace Freeform: Limited Twig template injection via submitted field values

Summary A limited server-side Twig template injection issue was identified in Solspace Freeform for Craft CMS. In affected versions, submitted form field values could be evaluated as Twig in certain rendering contexts. Unauthenticated users could submit Twig expressions through public Freeform...

GHSA-GXRG-X694-283W Solspace Freeform: Limited Twig template injection via submitted field values

Summary A limited server-side Twig template injection issue was identified in Solspace Freeform for Craft CMS. In affected versions, submitted form field values could be evaluated as Twig in certain rendering contexts. Unauthenticated users could submit Twig expressions through public Freeform...

CVE-2026-73858

The Solspace Freeform plugin for Craft CMS (versions 5.0.0 through 5.10.13) is vulnerable to a limited server-side Twig template injection (SSTI). An unauthenticated attacker can submit Twig expressions through public Freeform forms; these expressions are evaluated by the isolated Twig renderer w...

CVE-2026-73858 Solspace Freeform: Limited Twig template injection via submitted field values

Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in...

CVE-2026-73858 Solspace Freeform: Limited Twig template injection via submitted field values

Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in...

CVE-2026-73858 Solspace Freeform: Limited Twig template injection via submitted field values

Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in...

CVE-2026-73858: Improper Neutralization of Special Elements Used in a Template Engine

Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in...

CVE-2026-76086: Missing Authorization

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a...

CVE-2026-76087: Authorization Bypass Through User-Controlled Key

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a...

CVE-2026-76089: Exposure of Sensitive Information to an Unauthorized Actor

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level...

CVE-2026-92591

creationtimestamp| type| source ---|---|--- 2026-09-17 12:45:11+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-craft-cms 2026-09-23 06:25:01+00:00| seen| https://bsky.app/profile/fortrabbit.com/post/3mw647katym2g...

CVE-2026-92592

creationtimestamp| type| source ---|---|--- 2026-09-17 12:45:09+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-craft-cms 2026-09-19 05:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvtvlxhpnu2b 2026-10-03 07:00:09+00:00| seen|...

CVE-2026-92593

creationtimestamp| type| source ---|---|--- 2026-09-17 12:45:08+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-craft-cms 2026-09-19 05:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvtvlzaqwv2w 2026-09-23 06:25:01+00:00| seen|...

EUVD-2026-81293

Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl - View::renderObjectTemplate sink remained unsandboxed, and the same fix commit added a self-signing oracle in Cp::elementLabelHtml. Because Craft/Yii HMAC tokens are not...

EUVD-2026-81294

Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers usergroups.:read, these fields are gated only on the elements.drafts:read / elements.revisions:read...

EUVD-2026-81291

Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed production site whenever PHP remains available but the configured MySQL endpoint does...