Missing Authorization Vulnerability in Grav Star Ratings by Grav

CVE-2026-109323

What is CVE-2026-109323?

The Grav Star Ratings plugin versions 2.0.1 through 2.0.3 is susceptible to a missing authorization flaw that allows unauthenticated users to manipulate vote submissions. By bypassing client-side vote access controls, attackers can exploit anonymous nonce values emitted by the getData() function to directly call addVote(), thereby enabling them to alter ratings and impact aggregate rating outputs without proper authentication or authorization checks.

References