CVE-2026-109319 getgrav CVE debrief

Who should care

Defenders responsible for Grav Guestbook plugin installations, particularly those using versions 0.5.0 and 0.5.1, should assess their exposure and take necessary actions to mitigate the vulnerability.

Why it matters

The CVE-2026-109319 vulnerability in Grav Guestbook plugin versions 0.5.0 and 0.5.1 allows unauthorized actions in moderation, requiring defenders to verify and update their installations to prevent data tampering and unauthorized content modification.

• An attacker could delete or approve Guestbook entries without proper authorization, potentially leading to data tampering or unauthorized content modification.
• The vulnerability requires authentication but can be exploited via nonce-less GET requests, making it easier for attackers to perform actions as an authorized user.
• Defenders need to verify the presence of this vulnerability in their installations and update the plugin to a patched version to prevent exploitation.
• The CVSS score of 5.3 indicates a medium severity, emphasizing the need for prompt attention and remediation.

Technical summary

The Grav Guestbook plugin versions 0.5.0 and 0.5.1 are vulnerable to missing authorization and cross-site request forgery (CSRF) in moderation actions. This allows authenticated Admin users lacking the admin.guestbook permission or external sites to delete or approve Guestbook entries via nonce-less GET requests. The vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. Defenders should prioritize verifying the presence of this vulnerability in their Grav Guestbook plugin installations and ensure that the plugin is updated to a version that addresses this issue.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their Grav Guestbook plugin installations and ensure that the plugin is updated to a version that addresses this issue.

Recommended defensive actions

• Verify the Grav Guestbook plugin version and update to a patched version if necessary
• Review and restrict Admin user permissions to ensure only authorized users can perform moderation actions
• Implement CSRF protection for moderation actions
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to vendor advisories. The CVE Program record (cve-org) and NIST NVD detail page (nvd) offer official information on the vulnerability. Additionally, the source item (source-item) and vendor advisories (ref-4, ref-5) provide further context on the vulnerability and its impact. Defenders should review these sources to understand the vulnerability and its potential effects on their systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.