CVE-2026-109316 Details
Description
Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Admin integration. Attackers can send a request with the delete parameter and known data type and filename to remove files under user/data/, including form submissions, or forge requests lacking CSRF nonce checks.
A missing authorization vulnerability has been identified in the Grav Data Manager plugin, specifically in versions 1.4.0 through 1.4.5. This vulnerability allows unauthenticated attackers to delete stored data files via the classic Admin integration. Attackers can send a request with the delete parameter, along with a known data type and filename, to remove files located under user/data/. This includes deletion of form submission data. Additionally, attackers can forge requests that bypass CSRF nonce checks, further exploiting this vulnerability.
Users are advised to upgrade to Grav Data Manager version 1.4.6, which requires an authenticated authorized administrator and a valid Admin nonce before allowing file deletions.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav Data Manager | >= 1.4.0, < 1.4.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |