CVE-2026-109319
Received Received - Intake

Cross-Site Request Forgery in Grav Guestbook Plugin

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. Authenticated Admin users lacking the admin.guestbook permission, or external sites abusing a moderator's session via nonce-less GET requests, can delete or approve Guestbook entries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109319
EUVD
EUVD-2026-97621

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav grav-plugin-guestbook 0.5.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Grav Guestbook plugin versions 0.5.0 and 0.5.1 have missing authorization and cross-site request forgery vulnerabilities in admin moderation actions. Authenticated admin users without the admin.guestbook permission can delete or approve guestbook entries. External sites can also exploit a moderator's session via nonce-less GET requests to perform these actions.

Detection Guidance

Check for unauthorized deletion or approval of Guestbook entries by reviewing logs for actions performed by users lacking admin.guestbook permission or suspicious GET requests without proper nonces. Inspect Grav Guestbook plugin version 0.5.0 or 0.5.1 for these activities.

Impact Analysis

An attacker could delete or approve guestbook entries without proper authorization, potentially altering or removing legitimate user submissions. This could lead to loss of data integrity, unauthorized content manipulation, or disruption of guestbook functionality.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized modification or deletion of user-generated content, potentially violating data integrity and access control requirements in GDPR and HIPAA. Unauthorized changes may lead to non-compliance with record-keeping and audit trail obligations.

Mitigation Strategies

Upgrade Grav Guestbook plugin to a patched version if available. Remove or restrict admin.guestbook permission for users who do not require it. Implement CSRF protection by ensuring all moderation actions use nonces. Monitor and audit Guestbook entries for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109319. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart