CVE-2026-109314 getgrav CVE debrief

Who should care

Defenders responsible for Grav installations, particularly those using versions 1.2.0 before 3.9.9, should assess exposure and prioritize updates. This includes administrators, security teams, and IT personnel who manage Grav installations. They should review existing pages for potential exploitation and monitor for suspicious activity.

Why it matters

CVE-2026-109314 is a high-severity vulnerability in the Grav Login plugin that allows for password-reset token disclosure. Defenders should prioritize updating to version 3.9.9 or later and review existing pages for potential exploitation. The vulnerability requires verification of affected versions and exploitation scope.

• Potential account takeover due to exposed password-reset tokens
• Increased risk for privilege escalation
• Possible unauthorized access to sensitive information
• Need for urgent patching to prevent exploitation

Technical summary

The Grav Login plugin versions 1.2.0 before 3.9.9 contain an information disclosure vulnerability. This vulnerability allows publishers to obtain password-reset tokens by creating a page at the reset route. When a victim opens an emailed reset link, the publisher-controlled page rendered by Login::getPage() exposes the username and bearer token. The vulnerability is caused by inadequate validation of user input, allowing an attacker to access sensitive information. Defenders should prioritize updating to version 3.9.9 or later and review existing pages for potential exploitation.

Defensive priority

Defenders should prioritize updating to version 3.9.9 or later and review existing pages for potential exploitation.

Recommended defensive actions

• Update Grav Login plugin to version 3.9.9 or later
• Review existing pages for potential exploitation
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information about the vulnerability. Vendor advisories and third-party advisories offer additional context. The vulnerability has been verified by multiple sources, and its severity has been assessed. However, the exact scope of affected systems and potential impact are still being investigated. Defenders should verify the vulnerability's presence in their environments and review existing pages for potential exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.