CVE-2026-86194
Grav Form Plugin before 9.1.22 Cross-Page Form Execution
- State
- Published
- Severity
- 6.9 Medium
- Published
- Sep 5, 2026
- Updated
- Sep 18, 2026
- Reserved
- Sep 5, 2026
Description
Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form's name to trigger save, upload, email, or call actions without authentication.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
grav-plugin-formgetgrav |
|
References
- GitHub Security Advisory (GHSA-33m4-m988-5fvh)vendor-advisory
- VulnCheck Advisory: Grav Form Plugin before 9.1.22 Cross-Page Form Executionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.