CVE-2026-72699

CVSS 9.3 (critical) · published 2026-08-25

The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration. The register() method in classes/Login.php throws a distinct exception (EMAIL_NOT_AVAILABLE) when a submitted email address already belongs to an existing account, while allowing registration to proceed otherwise. Because the registration endpoint has no rate limiting, an attacker can enumerate which email addresses have accounts on the site, one guess per request.

Weakness: CWE-203

Source: NVD CVE-2026-72699

References

• https://github.com/getgrav/grav/security/advisories/GHSA-crh8-xm27-j9g9
• https://www.vulncheck.com/advisories/grav-login-plugin-before-email-enumeration-via-registration
• https://github.com/getgrav/grav/security/advisories/GHSA-crh8-xm27-j9g9

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.