CVE-2026-109319 Details
Description
Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. Authenticated Admin users lacking the admin.guestbook permission, or external sites abusing a moderator's session via nonce-less GET requests, can delete or approve Guestbook entries.
A vulnerability exists in the Grav Guestbook plugin versions 0.5.0 and 0.5.1, where missing authorization and cross-site request forgery (CSRF) vulnerabilities allow for exploitation of Admin moderation actions such as delete, approve, and approveAll. Authenticated Admin users without the admin.guestbook permission, as well as external sites exploiting a moderator's session through nonce-less GET requests, can manipulate Guestbook entries. The issue arises because the plugin's Admin moderation actions do not properly verify permissions or CSRF tokens before executing state-changing requests.
Users are advised to upgrade to Grav Guestbook version 0.5.2, which includes the necessary permission checks and CSRF nonce requirements for Admin moderation actions.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav Guestbook | >= 0.5.0, < 0.5.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |