MEDIUM 5.3 NVD
CVE-2026-109319
Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve,
Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. Authenticated Admin users lacking the admin.guestbook permission, or external sites abusing a moderator's session via nonce-less GET requests, can delete or approve Guestbook entries.
References
- https://github.com/getgrav/grav/security/advisories/GHSA-wxr7-h5mm-c7mv
- https://www.vulncheck.com/advisories/grav-guestbook-plugin-0.5.0-and-0.5.1-missing-authori
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-12 via NVD.
vulnfeed aggregates 10929 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.