Email Address Enumeration Vulnerability in Grav Login Plugin by Getgrav

CVE-2026-72699

What is CVE-2026-72699?

The Grav Login Plugin prior to version 3.9.1 is susceptible to an email address enumeration vulnerability. This arises from the register() method in classes/Login.php, which returns a specific exception (EMAIL_NOT_AVAILABLE) if an email address is already registered. This behavior allows malicious actors to determine registered emails with minimal effort, as the registration endpoint lacks any rate limiting. Each attempt reveals whether the specified email address corresponds to an active account, thereby exposing users to potential phishing or further targeted attacks.

References