CVE-2026-109323 Overview
CVE-2026-109323 is a missing authorization vulnerability [CWE-862] in the Grav Star Ratings plugin, affecting versions 2.0.1 through 2.0.3. The flaw allows unauthenticated visitors to submit votes by bypassing client-side vote_access and readonly enforcement. Attackers reuse the anonymous nonce emitted by the getData() function and send it directly to the addVote() endpoint. This lets them manipulate restricted or disabled ratings and skew aggregate rating output on affected sites.
Critical Impact
Unauthenticated attackers can forge votes on any rating item, corrupting integrity of displayed ratings and undermining content moderation controls.
Affected Products
- Grav Star Ratings 2.0.1
- Grav Star Ratings 2.0.2
- Grav Star Ratings 2.0.3
Discovery Timeline
- 2026-10-12 - CVE-2026-109323 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-109323
Vulnerability Analysis
The Grav Star Ratings plugin enforces vote access controls on the client side rather than the server. The getData() function emits an anonymous nonce intended to accompany legitimate vote submissions. Access gating relies on client-rendered flags such as vote_access and the readonly attribute, both of which an attacker controls or ignores. The server-side addVote() handler accepts the nonce without validating whether the requester is authorized to vote on the target rating. As a result, any network-reachable attacker can replay the nonce and submit arbitrary votes.
Root Cause
The root cause is missing server-side authorization, categorized under [CWE-862]. Authorization checks exist only in the user interface layer. The addVote() endpoint trusts the anonymous nonce as proof of eligibility and does not re-evaluate vote_access, readonly, or per-item restrictions before writing the vote.
Attack Vector
Exploitation requires only network access to a vulnerable Grav site. An attacker loads a page that invokes getData() to harvest the anonymous nonce, then issues direct HTTP requests to addVote() with chosen rating identifiers and values. Attackers can automate the request flow to inflate, deflate, or distort aggregate ratings, including on items marked as restricted or disabled. No authentication or user interaction is required.
See the GitHub Security Advisory GHSA-556j-6jh2-5rcv and the VulnCheck Advisory on Grav Ratings for additional technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-109323
Indicators of Compromise
- Unexpected spikes in vote counts or aggregate ratings on items configured as readonly or with restricted vote_access.
- Repeated HTTP POST requests to the addVote() endpoint originating from the same IP or short-lived session.
- Vote submissions carrying the anonymous nonce from getData() for rating IDs that should not accept public input.
Detection Strategies
- Review web server access logs for high-frequency requests targeting the Star Ratings vote endpoint.
- Correlate vote submissions against the authentication state of the requester to flag anonymous writes to restricted items.
- Baseline normal rating activity and alert on statistical anomalies in vote volume or distribution.
Monitoring Recommendations
- Enable verbose logging on Grav plugin endpoints and forward logs to a centralized analytics platform.
- Monitor for scripted user agents and non-browser request patterns hitting rating endpoints.
- Track changes to aggregate rating values on sensitive content and alert on sudden shifts.
How to Mitigate CVE-2026-109323
Immediate Actions Required
- Identify all Grav installations running Star Ratings versions 2.0.1 through 2.0.3 and prioritize them for update.
- Temporarily disable the Star Ratings plugin on exposed sites until a patched version is deployed.
- Audit existing rating data for signs of tampering and reset aggregate values where manipulation is suspected.
Patch Information
Review the vendor advisory at GitHub Security Advisory GHSA-556j-6jh2-5rcv for the fixed version and upgrade instructions. Apply the vendor-supplied update that enforces server-side vote_access and readonly checks within addVote().
Workarounds
- Block or rate-limit requests to the Star Ratings vote endpoint at the web application firewall layer.
- Require authenticated sessions for all vote submissions by restricting the endpoint through server configuration.
- Remove or hide rating widgets on restricted content until the plugin is updated.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
