Grav Guestbook CVE-2026-109319

Requires a target running the Grav Guestbook plugin version 0.5.0 or 0.5.1 with the admin moderation interface in use. Path one (missing authorization): an authenticated Grav admin account that lacks the admin.guestbook permission can still call the delete, approve, and approveAll moderation actions - the limiting factor is needing any valid low-privilege admin login. Path two (CSRF): an external site can drive a moderator's authenticated session using nonce-less GET requests, limited by the need for a currently logged-in moderator to trigger the attacker-supplied request. Impact is bounded to the integrity of guestbook entries (deletion or approval); there is no confidentiality or availability impact and no code execution.

This is a medium-severity integrity issue (input CVSS 4.0 base 5.3, VI:L with VC:N/VA:N) whose real-world priority is low. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) models the missing-authorization path, where a logged-in admin user without the admin.guestbook permission can still perform moderation - hence PR:L (authenticated) per the precision rules. The description also establishes a distinct CSRF path (nonce-less GET) that instead requires a victim moderator's active session and interaction, which the single provided vector does not fully capture - the two attack modes have different prerequisites, so treat the one published vector as representing only the authorization-bypass angle. No EPSS score, no CISA KEV listing, and no public exploit were provided; by the precision rules this is 'no public exploit identified at time of analysis.' Impact is confined to deleting or approving guestbook entries (low integrity impact only, no confidentiality or availability), so even successful exploitation is low-consequence. Net: a legitimate but non-urgent patch-on-schedule issue, not an emergency.

An attacker hosts a web page that silently issues a nonce-less GET request to a Grav site's guestbook moderation endpoint; when a logged-in moderator visits the page, their browser performs delete/approve/approveAll actions without their consent (CSRF). Alternatively, a low-privilege authenticated admin account that was never granted the admin.guestbook permission can invoke the same moderation actions directly because the authorization check is missing. No public exploit code was identified in the provided data.