Authorization and CSRF Vulnerabilities in Grav Guestbook Plugin by Grav

CVE-2026-109319

What is CVE-2026-109319?

The Grav Guestbook plugin versions 0.5.0 and 0.5.1 exhibit critical design flaws, specifically missing authorization checks and vulnerabilities to Cross-Site Request Forgery (CSRF) in admin moderation actions such as delete, approve, and approveAll. These vulnerabilities can potentially allow authenticated admin users who lack the necessary permissions (admin.guestbook) to execute unauthorized actions. Additionally, external sites can exploit a moderator's session using nonce-less GET requests, leading to unauthorized deletion or approval of Guestbook entries, posing significant risks to the integrity of user-generated content.

References