CVE-2026-56709: Grav before 3.9.2 Host Header Injection via sendInvitationEmail
Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled domains, bypassing the requiretrustedhost protection which only covers password reset flows.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Grav installations running versions before 3.9.2 are exposed when they use the sendInvitationEmail() function. The existing require_trusted_host protection does not protect invitation-email flows.
What does an attacker need to exploit it?
An attacker needs the ability to submit a request with a manipulated Host header to the invitation-email functionality. No authentication or user interaction is required to trigger the vulnerable server-side link construction.
What is the impact if exploitation succeeds?
The attacker can cause token-bearing invitation links to use an attacker-controlled domain. A recipient who follows the poisoned link may be redirected to the attacker-controlled site, exposing the invitation token.
How can this be remediated?
Upgrade Grav to version 3.9.2 or later. The affected versions are those before 3.9.2.