CVE-2026-109323 Details
Description
Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only vote_access and readonly enforcement. Attackers can use the anonymous nonce emitted by getData() to submit votes directly to addVote(), manipulating restricted or disabled ratings and aggregate rating output.
A missing authorization vulnerability has been identified in Grav Star Ratings versions 2.0.1 through 2.0.3. This vulnerability allows unauthenticated users to vote by bypassing client-side restrictions. The issue arises because the server does not enforce the 'vote_access' and 'readonly' settings, which are only applied in the browser. Attackers can exploit this by using the anonymous nonce provided by the 'getData()' function to submit votes directly to 'addVote()', thereby manipulating ratings and aggregate score outputs.
Users are advised to upgrade to Grav Star Ratings version 2.0.4, which addresses this vulnerability by enforcing the 'vote_access' and 'readonly' settings in the server-side vote handling process.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav Star Ratings | >= 2.0.1, <= 2.0.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |