CVE-2026-56709: Grav before 3.9.2 Host Header Injection via sendInvitationEmail

Q: Who is exposed to this issue?

Grav installations running versions before 3.9.2 are exposed when they use the sendInvitationEmail() function. The existing require_trusted_host protection does not protect invitation-email flows.

Q: What does an attacker need to exploit it?

An attacker needs the ability to submit a request with a manipulated Host header to the invitation-email functionality. No authentication or user interaction is required to trigger the vulnerable server-side link construction.

Q: What is the impact if exploitation succeeds?

The attacker can cause token-bearing invitation links to use an attacker-controlled domain. A recipient who follows the poisoned link may be redirected to the attacker-controlled site, exposing the invitation token.

Q: How can this be remediated?

Upgrade Grav to version 3.9.2 or later. The affected versions are those before 3.9.2.

Published Aug 25, 2026

Updated

Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled domains, bypassing the requiretrustedhost protection which only covers password reset flows.

Affected Software

1 affected component

Grav Grav<3.9.2

Event History

Aug 25, 2026

CVE Published

via MITRE·01:30 AM

Data Sourced

via MITRE·01:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Grav installations running versions before 3.9.2 are exposed when they use the sendInvitationEmail() function. The existing require_trusted_host protection does not protect invitation-email flows.

What does an attacker need to exploit it?

An attacker needs the ability to submit a request with a manipulated Host header to the invitation-email functionality. No authentication or user interaction is required to trigger the vulnerable server-side link construction.

What is the impact if exploitation succeeds?

The attacker can cause token-bearing invitation links to use an attacker-controlled domain. A recipient who follows the poisoned link may be redirected to the attacker-controlled site, exposing the invitation token.

How can this be remediated?

Upgrade Grav to version 3.9.2 or later. The affected versions are those before 3.9.2.

CVE-2026-56709: Grav before 3.9.2 Host Header Injection via sendInvitationEmail

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact if exploitation succeeds?

How can this be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact if exploitation succeeds?

How can this be remediated?