HIGH 8.7 NVD
CVE-2026-56709
Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing token-bearing invitation links. Attackers can
Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled domains, bypassing the require_trusted_host protection which only covers password reset flows.
References
- https://github.com/getgrav/grav/security/advisories/GHSA-69vf-mjxw-x79j
- https://www.vulncheck.com/advisories/grav-before-host-header-injection-via-sendinvitatione
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-08-25 via NVD.
vulnfeed aggregates 11266 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.