CVE-2026-109319: Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation

Published Oct 12, 2026

Updated

Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. Authenticated Admin users lacking the admin.guestbook permission, or external sites abusing a moderator's session via nonce-less GET requests, can delete or approve Guestbook entries.

Affected Software

1 affected component

Grav Guestbook Plugin=0.5.0, =0.5.1

Event History

Oct 12, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit the moderation actions?

Any authenticated Grav Admin user can exploit the missing authorization issue, including users who do not have the admin.guestbook permission. A separate CSRF path allows an external site to abuse a moderator's active session through nonce-less GET requests.

What actions can an attacker perform?

The affected moderation actions are delete, approve, and approveAll. An attacker can delete Guestbook entries or approve entries through those actions.

Which plugin versions are affected?

Grav Guestbook Plugin versions 0.5.0 and 0.5.1 are identified as affected.

CVE-2026-109319: Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation

Affected Software

Event History

Frequently Asked Questions

Who can exploit the moderation actions?

What actions can an attacker perform?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit the moderation actions?

What actions can an attacker perform?

Which plugin versions are affected?