Authorization Bypass in Grav Form Plugin

CVE-2026-86194

What is CVE-2026-86194?

The Grav Form Plugin prior to version 9.1.22 contains an authorization bypass vulnerability that allows unauthorized users to execute form actions across pages. This occurs due to the plugin's failure to verify page authorization when resolving forms by name. As a result, anonymous visitors can trigger save, upload, email, or call actions on login-restricted or unpublished pages simply by sending POST requests to public pages with the names of restricted forms. This flaw poses a significant security risk, enabling attackers to exploit vulnerabilities without proper authentication.

References