CVE-2026-109323
Received Received - Intake

Grav Star Ratings Missing Authorization Vulnerability

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only vote_access and readonly enforcement. Attackers can use the anonymous nonce emitted by getData() to submit votes directly to addVote(), manipulating restricted or disabled ratings and aggregate rating output.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109323
EUVD
EUVD-2026-97625

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav grav-plugin-star-ratings 2.0.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Grav Star Ratings 2.0.1 through 2.0.3 has a missing authorization flaw allowing unauthenticated users to vote by bypassing client-side restrictions. Attackers exploit an anonymous nonce from getData() to directly submit votes via addVote(), manipulating ratings even in restricted or disabled areas.

Detection Guidance

Check Grav Star Ratings plugin versions 2.0.1 through 2.0.3 for missing authorization. Inspect network traffic for direct POST requests to addVote() without authentication. Review server logs for unusual voting patterns or unauthorized nonce usage.

Impact Analysis

This vulnerability allows attackers to manipulate rating scores by submitting unauthorized votes. This can skew public perception of content, products, or services, leading to incorrect aggregate ratings and potential reputational damage for affected systems.

Compliance Impact

This vulnerability could potentially impact compliance with regulations requiring data integrity and access controls, such as GDPR or HIPAA, by allowing unauthorized modifications to rating data. If voting data is used for decision-making or user feedback that affects services covered under these regulations, the lack of server-side authorization could lead to unauthorized changes, compromising data reliability and regulatory adherence.

Mitigation Strategies

Upgrade Grav Star Ratings plugin to the latest version beyond 2.0.3. Implement server-side authorization checks for addVote() endpoints. Disable anonymous voting if not required. Monitor for suspicious voting activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109323. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart