CVE-2026-56709: Grav CMS Authentication Bypass Vulnerability

CVE-2026-56709 Overview

CVE-2026-56709 is a host header injection vulnerability in the Grav flat-file CMS affecting versions before 3.9.2. The sendInvitationEmail() function fails to validate untrusted Host headers when constructing token-bearing invitation links. Attackers can manipulate the Host header of an invitation request to poison the resulting email links, redirecting invited users to attacker-controlled domains. The existing require_trusted_host protection in Grav only covers password reset flows, leaving the invitation workflow exposed. Successful exploitation can lead to invitation token theft and account takeover of newly invited users. The issue is classified under [CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action].

Critical Impact
Attackers can hijack Grav invitation tokens by poisoning the Host header, redirecting invited users to attacker-controlled sites and enabling account takeover.

Affected Products

Grav CMS versions prior to 3.9.2
Grav deployments using the invitation workflow via sendInvitationEmail()
Grav instances where require_trusted_host is not enforced globally

Discovery Timeline

2026-08-25 - CVE-2026-56709 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-56709

Vulnerability Analysis

Grav generates user invitation emails by building an absolute URL that embeds a single-use invitation token. The URL host component is derived from the incoming HTTP Host header rather than from a server-side allowlist. Because sendInvitationEmail() does not consult the require_trusted_host configuration, an attacker who can trigger an invitation request supplies an arbitrary Host value. The victim receives an email containing a link that visually appears to originate from the legitimate application but resolves to the attacker's domain, where the token is captured on click.

Root Cause

The root cause is missing origin validation in the invitation email builder. Grav applies the require_trusted_host check to password reset flows but not to the invitation code path. The Host header, which is fully attacker-controlled at the HTTP layer, is trusted as authoritative when composing the token URL. This is a classic instance of [CWE-350], where a security decision depends on a name or header that adversaries can spoof.

Attack Vector

Exploitation requires no authentication and no user interaction on the initial request. The attacker sends an HTTP request to the Grav invitation endpoint with a spoofed Host header pointing at an attacker-controlled domain. Grav renders the invitation URL using that host and dispatches the email. When the invited user opens the link, their browser navigates to the attacker's site, which harvests the token and can then complete the invitation flow against the real Grav instance to seize the account.

No verified proof-of-concept code has been published. Technical details are documented in the GitHub Security Advisory GHSA-69vf-mjxw-x79j and the VulnCheck advisory.

Detection Methods for CVE-2026-56709

Indicators of Compromise

Outbound Grav invitation emails whose embedded links resolve to hostnames that differ from the canonical application FQDN.
Web server access logs showing requests to Grav invitation endpoints with Host header values not matching the configured site host.
Invitation token redemption requests originating from unexpected referrers or IP ranges.

Detection Strategies

Parse mail server logs for outbound Grav invitation messages and extract link hostnames, alerting when they diverge from the approved domain list.
Inspect reverse proxy or WAF logs for HTTP requests to Grav routes containing mismatched Host and X-Forwarded-Host headers.
Correlate invitation dispatch events with the source IP and Host header to surface abuse patterns from a single actor.

Monitoring Recommendations

Enable verbose logging on the Grav admin plugin for the invitation code path, including the resolved base URL used in each email.
Monitor authentication events for newly invited accounts that complete registration from anomalous geolocations or user agents.
Track DNS lookups from mail recipients toward domains that resemble typosquats of the legitimate Grav host.

How to Mitigate CVE-2026-56709

Immediate Actions Required

Upgrade Grav to version 3.9.2 or later, which extends require_trusted_host enforcement to the invitation workflow.
Configure the trusted_hosts allowlist in Grav to explicitly enumerate valid site hostnames before any invitations are issued.
Invalidate outstanding invitation tokens issued before the patch was applied and reissue them after the upgrade.

Patch Information

The fix is available in Grav 3.9.2. Refer to the GitHub Security Advisory GHSA-69vf-mjxw-x79j for commit-level details and release notes. Administrators should verify the security.yaml and system configuration files after upgrade to confirm that require_trusted_host is enabled and that the trusted host list covers all legitimate hostnames.

Workarounds

Place Grav behind a reverse proxy that rewrites or strips untrusted Host and X-Forwarded-Host headers before they reach the application.
Restrict access to the admin invitation endpoint to authenticated administrators on a management network until the upgrade is complete.
Enforce a static, server-side base URL in front-end infrastructure so that outbound links cannot be influenced by request headers.

bash

# Example reverse proxy hardening (nginx) to normalize the Host header
server {
    listen 443 ssl;
    server_name grav.example.com;

    location / {
        proxy_pass http://grav_backend;
        proxy_set_header Host grav.example.com;
        proxy_set_header X-Forwarded-Host grav.example.com;
        proxy_set_header X-Forwarded-Proto https;
    }
}