CVE-2026-72699 getgrav CVE debrief

Who should care

Administrators and users of the Grav Login plugin, especially those with publicly accessible registration endpoints, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and updating their current security measures to prevent potential enumeration of email addresses associated with existing accounts.

Technical summary

The Grav Login plugin (getgrav/grav-plugin-login) before version 3.9.1 is vulnerable to email address enumeration due to the register() method in classes/Login.php throwing a distinct exception when a submitted email address already belongs to an existing account. The registration endpoint lacks rate limiting, allowing an attacker to enumerate email addresses with one guess per request. This vulnerability can be mitigated by patching the plugin to version 3.9.1 or later and implementing rate limiting on the registration endpoint.

Defensive priority

Defenders should prioritize patching the Grav Login plugin to prevent potential enumeration of email addresses associated with existing accounts.

Recommended defensive actions

• Patch the Grav Login plugin to version 3.9.1 or later
• Implement rate limiting on the registration endpoint
• Monitor for suspicious registration activity
• Consider using a Web Application Firewall (WAF) to detect and prevent exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE-2026-72699 record indicates that the Grav Login plugin is vulnerable to email address enumeration due to the register() method in classes/Login.php throwing a distinct exception when a submitted email address already belongs to an existing account. The registration endpoint lacks rate limiting, allowing an attacker to enumerate email addresses with one guess per request. Official sources include the CVE Program and NVD.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.