Grav CMS CVE-2026-56709

The user invitation feature must be in active use - the vulnerability is triggered at the moment an invitation email is dispatched from a request bearing a forged Host header. The CVSS 4.0 PR:N metric suggests the invitation endpoint may be reachable without authentication, but this has not been independently confirmed; if Grav requires at minimum editor or admin credentials to send invitations (typical CMS behavior), the attacker must hold those credentials or induce a legitimate privileged user to send an invitation from a request the attacker has manipulated. A victim must click the poisoned link for the token to be captured - passive receipt of the email is not sufficient. Deployments that have disabled the invitation workflow, or that enforce Host header validation at a reverse proxy layer, are not exploitable through this path.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) scores at 8.7, reflecting network-accessible, low-complexity exploitation with high confidentiality impact. The PR:N (no privileges required) claim is the metric most in need of independent verification: in most CMS architectures, sending invitations requires at least low-privilege authenticated access, and if that is true of Grav, exploitability is meaningfully lower than the provided vector suggests. The UI:N metric similarly warrants scrutiny - practical exploitation requires a victim to click the poisoned link, introducing a real-world friction point not captured by that metric. No EPSS score was included in the available intelligence, no active exploitation is confirmed (not in CISA KEV), and no public POC has been identified at time of analysis. Taken together, the actual exploitation risk is somewhat lower than the raw CVSS score implies: this is a high-severity design gap that becomes a viable attack only when invitations are actively sent and victims act on the email.

An attacker sends an HTTP POST request to Grav's invitation-sending endpoint with a spoofed Host header (e.g., Host: attacker.example.com), triggering an invitation email to a targeted user whose address is known or guessed. The victim receives a legitimate-looking email and clicks the invitation link, which navigates their browser to attacker.example.com with the genuine one-time token appended as a URL parameter. The attacker's server logs the token, which can then be replayed directly against the real Grav site to complete account registration under attacker control.