EUVD-2026-71996
GHSA-99h4-pmfq-pv63
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible, no auth or user interaction needed; impact limited to L/L since confidentiality and integrity effects are configuration-dependent and do not universally reach high.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form's name to trigger save, upload, email, or call actions without authentication.
AnalysisAI
Unauthenticated form action execution in the Grav Form Plugin before 9.1.22 allows anonymous visitors to trigger save, upload, email, or call actions defined on login-restricted or unpublished pages. The plugin resolves forms by name across all pages without verifying whether the requesting user is authorized to access the page where the form is defined, so an attacker can POST to any public page while referencing a restricted form by name to bypass access controls entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Grav installation has at least one form defined on a login-restricted or unpublished page with at least one actionable handler (save, upload, email, or call). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is remotely exploitable by unauthenticated attackers with no special prerequisites, and the score of 6.9 reflects moderate confidentiality and integrity impact (VC:L/VI:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Grav Form Plugin to version 9.1.22 or later, the vendor-confirmed patched release per GHSA-33m4-m988-5fvh. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Grav Plugin Form
View allSame weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today