Grav Form Plugin Page Authorization Bypass

Executive Summary

CVE-2026-86194 affects the Grav Form Plugin before version 9.1.22. It allows anonymous visitors to execute form actions like save, upload, email, or call on login-restricted or unpublished pages by sending a POST request to a public page with the restricted form's name. The plugin fails to verify page authorization when resolving forms across pages, enabling unauthorized actions without authentication.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the Grav Form Plugin. If it is below 9.1.22, the system is vulnerable. Use commands like 'composer show | grep gravityforms' or inspect the plugin directory for version files.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to perform unauthorized actions such as saving data, uploading files, sending emails, or invoking callbacks on restricted forms. Attackers can bypass access controls and potentially write files, send malicious emails, or trigger unintended callbacks without needing valid credentials or privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Unauthorized form actions may result in data breaches, unauthorized disclosures, or improper handling of sensitive data, potentially leading to compliance violations and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Grav Form Plugin to version 9.1.22 or later immediately. Remove or disable the plugin if an update is not possible. Review server logs for suspicious POST requests to form endpoints.

Useful 0 Not Useful 0