Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-72699: Grav Login Plugin allows attackers to discover registered email addresses
CVE-2026-72699 · published 2 months ago
Summary
The login extension used by Grav sites lets anyone try to sign up and see whether an email address is already in use. Because there is no limit on how quickly these checks can be made, a malicious user can test many addresses and learn which ones belong to existing accounts. To protect your site, upgrade the plugin to version 3.9.1 or later and consider adding rate‑limiting or a captcha to the registration form.
What to do
- Update getgrav grav to version 3.9.1 or later.
- Update getgrav grav-plugin-login to version 3.9.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| getgrav | grav | < 3.9.1 |
| getgrav | grav-plugin-login | < 3.9.1 |
Original advisory text
Grav Login Plugin before 3.9.1 Email Enumeration via Registration
The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration. The register() method in classes/Login.php throws a distinct exception (EMAIL_NOT_AVAILABLE) when a submitted email address already belongs to an existing account, while allowing registration to proceed otherwise. Because the registration endpoint has no rate limiting, an attacker can enumerate which email addresses have accounts on the site, one guess per request.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
9.3
Critical
Type
CWE-203Observable Discrepancy
Timeline
Published25 Aug 2026
Updated4 Nov 2026
First seen25 Aug 2026
Track software like this
Free during beta