CVE-2026-109323: Grav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote_access Authorization

Q: Who can exploit this issue?

Any unauthenticated visitor who can reach the affected rating functionality can submit votes. No account, privileges, or user interaction are required.

Q: What does an attacker need to submit unauthorized votes?

The attacker needs the anonymous nonce emitted by getData() and can use it to send vote requests directly to addVote(). The client-side vote_access and readonly controls do not prevent these direct submissions.

Q: Are restricted or disabled ratings affected?

Yes. The issue allows votes to be submitted to ratings that are restricted through vote_access or marked readonly, which can alter aggregate rating output.

Q: How can I tell whether an installation is affected?

Installations using Grav Star Ratings versions 2.0.1 through 2.0.3 are affected. Affected behavior is indicated if an unauthenticated visitor can obtain the anonymous nonce from getData() and submit a vote directly to addVote() for a restricted or readonly rating.

Published Oct 12, 2026

Updated

Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only voteaccess and readonly enforcement. Attackers can use the anonymous nonce emitted by getData() to submit votes directly to addVote(), manipulating restricted or disabled ratings and aggregate rating output.

Affected Software

1 affected component

Grav Star Ratings>=2.0.1<=2.0.3

Event History

Oct 12, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated visitor who can reach the affected rating functionality can submit votes. No account, privileges, or user interaction are required.

What does an attacker need to submit unauthorized votes?

The attacker needs the anonymous nonce emitted by getData() and can use it to send vote requests directly to addVote(). The client-side vote_access and readonly controls do not prevent these direct submissions.

Are restricted or disabled ratings affected?

Yes. The issue allows votes to be submitted to ratings that are restricted through vote_access or marked readonly, which can alter aggregate rating output.

How can I tell whether an installation is affected?

Installations using Grav Star Ratings versions 2.0.1 through 2.0.3 are affected. Affected behavior is indicated if an unauthenticated visitor can obtain the anonymous nonce from getData() and submit a vote directly to addVote() for a restricted or readonly rating.

CVE-2026-109323: Grav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote_access Authorization

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to submit unauthorized votes?

Are restricted or disabled ratings affected?

How can I tell whether an installation is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to submit unauthorized votes?

Are restricted or disabled ratings affected?

How can I tell whether an installation is affected?