CVE-2026-109323: Grav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote_access Authorization
Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only voteaccess and readonly enforcement. Attackers can use the anonymous nonce emitted by getData() to submit votes directly to addVote(), manipulating restricted or disabled ratings and aggregate rating output.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated visitor who can reach the affected rating functionality can submit votes. No account, privileges, or user interaction are required.
What does an attacker need to submit unauthorized votes?
The attacker needs the anonymous nonce emitted by getData() and can use it to send vote requests directly to addVote(). The client-side vote_access and readonly controls do not prevent these direct submissions.
Are restricted or disabled ratings affected?
Yes. The issue allows votes to be submitted to ratings that are restricted through vote_access or marked readonly, which can alter aggregate rating output.
How can I tell whether an installation is affected?
Installations using Grav Star Ratings versions 2.0.1 through 2.0.3 are affected. Affected behavior is indicated if an unauthenticated visitor can obtain the anonymous nonce from getData() and submit a vote directly to addVote() for a restricted or readonly rating.