Grav Login Plugin CVE-2026-72699

Exploitation requires that the Grav site has the Login plugin (before 3.9.1) installed with public self-registration enabled and reachable, which is the specific deployment mode where the register() endpoint is exposed to unauthenticated users. The concrete oracle is the distinct EMAIL_NOT_AVAILABLE exception returned for already-registered addresses versus normal progression for new ones, and the enabling factor is the absence of rate limiting on that endpoint. Limiting factors: if open registration is disabled, gated behind admin approval, or protected by an external rate-limiter/CAPTCHA/WAF, the enumeration oracle is unavailable or throttled; the vulnerability discloses only account existence and grants no access to the accounts themselves.

The signals here conflict sharply and must be read critically. The provided CVSS 4.0 vector claims high confidentiality, integrity, AND availability impact (VC:H/VI:H/VA:H) for a score of 9.3, but the underlying weakness is email enumeration - an information-disclosure issue that in reality has at most limited confidentiality impact and no integrity or availability impact. This is a case of high-CVSS-but-low-real-risk: the numeric severity does not match the described behavior, and defenders should not treat this as a critical RCE-class issue. Genuine risk factors are that exploitation is network-reachable, unauthenticated (PR:N), low-complexity, and requires no user interaction, so enumeration itself is trivial and automatable. However, no EPSS score, KEV listing, POC, or SSVC data was provided, and there is no public exploit identified. The practical impact is reconnaissance - harvesting valid account emails to feed phishing, credential-stuffing, or password-spray campaigns - not direct compromise of the host.

An attacker scripts requests against a Grav site's public registration form, submitting a wordlist of candidate email addresses. Addresses that already have accounts return the distinct EMAIL_NOT_AVAILABLE error while unknown addresses proceed toward registration, and with no rate limiting the attacker rapidly compiles a list of valid users to target with phishing or password-spray attacks. No public POC is identified, but the technique is trivial to implement given the low attack complexity.