by Kastro
Paper/Archive/CVE-2026-72699

CVE-2026-72699

getgrav grav-plugin-login — Grav Login Plugin before 3.9.1 Email Enumeration via Registration

EPSS 0.3%public exploitCVSS 9.3
critical.is priorityof 100
41
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 17.4.174 × 203.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration. The register() method in classes/Login.php throws a distinct exception (EMAIL_NOT_AVAILABLE) when a submitted email address already belongs to an existing account, while allowing registration to proceed otherwise. Because the registration endpoint has no rate limiting, an attacker can enumerate which email addresses have accounts on the site, one guess per request.

Affected

ProductAffectedFixed inSource
grav-plugin-login< 3.9.13.9.1CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VulnCheck (CNA)5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

exploitgithub.com/getgrav/grav/security/advisories/GHSA-crh8-xm27-j9g9writeupvulncheck.com/advisories/grav-login-plugin-before-email-enumeration-via-registration