CVE-2026-109319: Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation
Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. Authenticated Admin users lacking the admin.guestbook permission, or external sites abusing a moderator's session via nonce-less GET requests, can delete or approve Guestbook entries.
Affected Software
Event History
Frequently Asked Questions
Who can exploit the moderation actions?
Any authenticated Grav Admin user can exploit the missing authorization issue, including users who do not have the admin.guestbook permission. A separate CSRF path allows an external site to abuse a moderator's active session through nonce-less GET requests.
What actions can an attacker perform?
The affected moderation actions are delete, approve, and approveAll. An attacker can delete Guestbook entries or approve entries through those actions.
Which plugin versions are affected?
Grav Guestbook Plugin versions 0.5.0 and 0.5.1 are identified as affected.