Grav Data Manager CVE-2026-109316

The target must run the Grav Data Manager plugin version 1.4.0 through 1.4.5 with the classic Admin integration in use. The attacker needs no authentication and no user interaction (CVSS PR:N/UI:N), but must know a valid data type and the filename of the target file under user/data/ to delete it; the request succeeds because the endpoint performs no authorization check and lacks CSRF nonce validation. Limiting factors: exploitation is confined to deleting existing data files (integrity/availability impact only, no read/exfiltration of contents), it requires the vulnerable plugin version and the classic Admin integration to be present, and installs on fixed versions outside the 1.4.0-1.4.5 range are not affected.

This is a moderate-severity missing-authorization flaw (CWE-862) in the Grav Data Manager plugin, reported by VulnCheck with a CVSS 4.0 base score of 6.9. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L) indicates remote, unauthenticated exploitation with low complexity and no user interaction, but limited impact: integrity and availability are rated Low and confidentiality is None, consistent with a file-deletion bug rather than code execution or data theft. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The combination of trivial exploitability (no auth, no UI) with only Low integrity/availability impact means this is a real but bounded priority: easy to abuse for destructive or disruptive purposes (deleting form submissions and stored data) yet not a confidentiality breach or RCE. The 'Authentication Bypass' and 'CSRF' tags are consistent with the description's dual vector (missing authorization plus absent CSRF nonce checks). No key signals directly conflict; the main gap is the absence of EPSS/KEV/POC data, which should be treated as 'not provided' rather than evidence of low real-world interest.

An attacker identifies a Grav site running the Data Manager plugin (v1.4.0-1.4.5) with the classic Admin integration and sends an unauthenticated HTTP request containing the delete parameter plus a known data type and filename. The server deletes the targeted file under user/data/ - for example wiping collected form submissions - without verifying authorization or a CSRF nonce. No public proof-of-concept is referenced, but the attack requires no authentication, no user interaction, and only knowledge of a valid data type and filename.