AIKIDO-2026-723224

TL;DR

The EmailController preview and test-send actions enforce no Formie permission and no control-panel access, so any authenticated Craft user, including a self-registered front-end account, can reach them. Both actions build a Notification entirely from request input with mass-assignment filtering disabled, letting the caller send email through the site mailer with a chosen recipient, from, subject and body, and render arbitrary notification content. Because notification fields are evaluated as Twig, the actions also expose sandboxed server-side template injection. The fix requires control-panel access and Formie permissions on both actions and restricts which notification attributes can be populated.