CVE-2026-109316: Grav Data Manager Auth Bypass Vulnerability

CVE-2026-109316 Overview

CVE-2026-109316 is a missing authorization vulnerability [CWE-862] in the Grav Data Manager plugin versions 1.4.0 through 1.4.5. The flaw lets unauthenticated attackers delete stored data files through the classic Admin integration. Attackers submit a request containing the delete parameter along with a known data type and filename to remove files beneath user/data/. Affected files include form submissions and other data entries managed by the plugin. The vulnerability also permits forged requests that bypass Cross-Site Request Forgery (CSRF) nonce checks.

Critical Impact

Unauthenticated remote attackers can delete arbitrary files under user/data/, destroying form submissions and other persisted plugin data without any user interaction.

Affected Products

• Grav Data Manager plugin 1.4.0
• Grav Data Manager plugin 1.4.1 through 1.4.4
• Grav Data Manager plugin 1.4.5

Discovery Timeline

• 2026-10-12 - CVE-2026-109316 published to NVD
• 2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109316

Vulnerability Analysis

The Grav Data Manager plugin exposes a delete action through its classic Admin integration without enforcing an authentication or authorization check. An attacker who knows a valid data type identifier and filename can issue a crafted HTTP request that removes the matching file from the user/data/ directory. Because the handler accepts requests lacking a valid CSRF nonce, requests can also be forged through other channels. The impact is limited to integrity and availability of stored data; the vulnerability does not expose file contents or allow code execution. Form submissions, contact entries, and other plugin-managed records are the primary assets at risk.

Root Cause

The root cause is a missing authorization check [CWE-862] on the delete handler in the plugin's Admin integration. The handler trusts the delete parameter, data type, and filename supplied by the client without first verifying session identity, role, or a server-issued nonce.

Attack Vector

Exploitation is performed over the network with low attack complexity and no privileges or user interaction. An attacker submits an HTTP request to the Admin endpoint registered by the Data Manager plugin, supplying the delete parameter along with a known data type and filename. CSRF-style forgery is also viable because nonce validation is absent. Technical details are documented in the GitHub Security Advisory GHSA-mh96-26mx-hf3g and the VulnCheck Advisory: Grav Data Manager Issue.

Detection Methods for CVE-2026-109316

Indicators of Compromise

• Unauthenticated HTTP requests to Admin endpoints associated with the Data Manager plugin that carry a delete parameter.
• Unexpected removal of files beneath the user/data/ directory, especially form submission records.
• Access log entries showing POST or GET requests to the Admin integration without a prior authenticated session.
• Requests to the delete handler that do not include a valid CSRF nonce value.

Detection Strategies

• Review web server access logs for requests referencing the Data Manager delete endpoint originating from untrusted sources.
• Monitor file system events on user/data/ for unlink operations outside administrator activity windows.
• Correlate HTTP request bodies containing the delete parameter with the absence of an authenticated admin session cookie.

Monitoring Recommendations

• Enable file integrity monitoring on the Grav user/data/ directory to capture deletion events.
• Alert on repeated 2xx responses from the Data Manager admin route by unauthenticated clients.
• Retain application and web server logs long enough to reconstruct deletion sequences for incident response.

How to Mitigate CVE-2026-109316

Immediate Actions Required

• Upgrade the Grav Data Manager plugin to a version later than 1.4.5 as published in the vendor advisory.
• Restrict network access to the Grav Admin interface to trusted IP ranges or a VPN until patching is complete.
• Back up the user/data/ directory so deleted form submissions can be restored if exploitation occurred.

Patch Information

Refer to the GitHub Security Advisory GHSA-mh96-26mx-hf3g for the fixed version and upgrade guidance. The VulnCheck Advisory: Grav Data Manager Issue provides additional remediation context.

Workarounds

• Disable the Data Manager plugin until the upgrade is applied if the Admin interface cannot be isolated.
• Place the Grav Admin path behind an authenticating reverse proxy or HTTP basic authentication layer.
• Apply web application firewall rules that block requests to the Data Manager delete endpoint lacking a valid admin session cookie and CSRF nonce.

# Configuration example: restrict Admin path at the reverse proxy
location /admin {
    allow 10.0.0.0/8;
    deny all;
    auth_basic "Restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://grav_backend;
}