CVE-2026-72699: Grav Login Plugin before 3.9.1 Email Enumeration via Registration
The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration. The register() method in classes/Login.php throws a distinct exception (EMAILNOTAVAILABLE) when a submitted email address already belongs to an existing account, while allowing registration to proceed otherwise. Because the registration endpoint has no rate limiting, an attacker can enumerate which email addresses have accounts on the site, one guess per request.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the Grav Login plugin before version 3.9.1 with a reachable registration endpoint are exposed. An attacker can test whether email addresses correspond to existing accounts.
What does an attacker need to exploit it?
The attacker needs only network access to the registration endpoint and candidate email addresses. No authentication, user interaction, or special conditions are required, and each guess can be made in a separate request.
Are default protections sufficient to stop enumeration?
The affected registration endpoint has no rate limiting, so repeated email guesses are not restricted by that endpoint. The distinct EMAIL_NOT_AVAILABLE exception reveals when an address is already associated with an account.
How can I determine whether my site is vulnerable?
Check whether the site uses getgrav/grav-plugin-login before 3.9.1 and whether registration is available. On an affected version, submitting an email already tied to an account produces a different result from submitting an unregistered email address.