CVE-2026-109319

MediumCVSS 4.3

Published: 12/10/2026(UTC)Updated: 15/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. Authenticated Admin users lacking the admin.guestbook permission, or external sites abusing a moderator's session via nonce-less GET requests, can delete or approve Guestbook entries.

Risk Assessment

The risk includes unauthorized deletion or approval of entries, potentially leading to data loss or content manipulation.

Recommendation

Update the Grav Guestbook plugin to version 0.5.2 or later, which includes fixes enforcing authorization and CSRF protection.

Other vulnerabilities in Grav Guestbook

CVE-2026-109322Medium
Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other visitors' browsers and, in versions 0.5.0 and 0.5.1, in administrator moderation sessions.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS