CVE-2026-86194 Details
Description
Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form's name to trigger save, upload, email, or call actions without authentication.
A vulnerability exists in the Grav Form Plugin in versions prior to 9.1.22, where the plugin fails to properly verify page authorization when forms are resolved by name across different pages. This oversight allows anonymous users to execute actions defined on forms from login-restricted or unpublished pages. By posting to any public page with the name of a restricted form, an attacker can trigger actions such as saving data, uploading files, sending emails, or invoking callable functions, all without authentication.
Users can update to Grav Form Plugin version 9.1.22 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 5, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-33m4-m988-5fvh | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/grav-form-plugin-before-9.1.22-cross-page-form-execution | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav Form | <= 9.1.21 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 5, 2026 | New CVE Received | [email protected] |