[HIGH] Formie: Missing authorization on sent notification resend modal exposes submission PII

PKSA-4fhy-ttgn-65dd CVE-2026-76089 GHSA-9rg8-2wvr-fgjh

Affected version: <2.2.23|>=3.0.0,<3.1.31

Reported by:
GitHub

[HIGH] Formie: Unauthenticated users can overwrite incomplete submissions via submit action

PKSA-zdww-z1qy-tc3x CVE-2026-76087 GHSA-584p-f93j-wpgc

Affected version: <2.2.23|>=3.0.0,<3.1.31

Reported by:
GitHub

[HIGH] Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

PKSA-mwqg-ntj6-7bx8 CVE-2026-76086 GHSA-v3f3-cmj4-cvj9

Affected version: <2.2.23|>=3.0.0,<3.1.31

Reported by:
GitHub