CVE-2026-72699 Overview
The Grav Login plugin (getgrav/grav-plugin-login) before version 3.9.1 contains an email address enumeration vulnerability in its registration workflow. The register() method in classes/Login.php returns a distinct EMAIL_NOT_AVAILABLE exception when a submitted email already belongs to an existing account. Registration proceeds normally otherwise, creating an observable behavioral difference between registered and unregistered addresses. The registration endpoint enforces no rate limiting, so an attacker can iterate through email lists and confirm which addresses have accounts on the target site. This information supports targeted phishing, credential stuffing, and password reset abuse campaigns against confirmed users.
Critical Impact
Unauthenticated remote attackers can enumerate valid user accounts on Grav sites at scale, exposing user identities and enabling downstream account takeover activity.
Affected Products
- Grav Login plugin (getgrav/grav-plugin-login) versions prior to 3.9.1
- Grav CMS installations that expose the Login plugin registration endpoint
- Any Grav-based site permitting self-service user registration
Discovery Timeline
- 2026-08-25 - CVE-2026-72699 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-72699
Vulnerability Analysis
The flaw is classified as an observable discrepancy weakness [CWE-203]. The register() method in classes/Login.php branches its response based on whether the submitted email address exists in the user store. Existing addresses trigger an EMAIL_NOT_AVAILABLE exception, while new addresses continue through the standard registration path. An attacker observes the response body, status code, or timing to determine account existence.
The registration endpoint accepts unauthenticated requests and applies no rate limiting or CAPTCHA. Attackers can automate high-volume enumeration against email lists purchased or scraped from breach corpora. Confirmed accounts feed targeted phishing, password reset floods, and credential-stuffing campaigns against the identified users.
Root Cause
The root cause is inconsistent error handling that discloses account state through distinct exception types. The registration flow should return a uniform response regardless of whether the email is already registered, deferring uniqueness confirmation to an out-of-band email verification step. The absence of rate limiting compounds the disclosure by permitting unlimited guesses.
Attack Vector
Exploitation requires only network access to the public registration form. An attacker submits registration requests containing candidate email addresses and inspects the server response. Responses indicating EMAIL_NOT_AVAILABLE confirm a registered account. The attack scales linearly with request throughput because no throttling is enforced. Full technical details are available in the GitHub Security Advisory and the VulnCheck Advisory.
Detection Methods for CVE-2026-72699
Indicators of Compromise
- High volumes of POST requests to the Grav registration endpoint from a single source or distributed set of sources
- Repeated registration attempts producing EMAIL_NOT_AVAILABLE responses in application logs
- Sequential or dictionary-ordered email addresses appearing in registration request bodies
- User-Agent strings associated with automation frameworks or headless browsers hitting /user/register paths
Detection Strategies
- Alert on registration endpoints receiving request rates that exceed a baseline established from historical traffic
- Correlate registration failures by source IP and Autonomous System Number to surface distributed enumeration
- Inspect web server access logs for repeated POST requests to the Grav registration URL followed by short client sessions
Monitoring Recommendations
- Forward Grav application and web server logs to a centralized analytics platform for behavioral baselining
- Track ratio of successful registrations to failed registrations per source; enumeration campaigns skew heavily toward failures
- Monitor downstream password reset and login endpoints for follow-on activity against newly enumerated accounts
How to Mitigate CVE-2026-72699
Immediate Actions Required
- Upgrade the Grav Login plugin to version 3.9.1 or later on all affected Grav installations
- Audit registration and login logs for enumeration patterns predating the upgrade
- Notify users whose accounts may have been enumerated and encourage password hygiene and multi-factor authentication
Patch Information
The maintainers resolved the issue in getgrav/grav-plugin-login version 3.9.1. Site operators should update the plugin through the Grav Package Manager or by pulling the latest release from the project repository. Review the GitHub Security Advisory GHSA-crh8-xm27-j9g9 for release notes and remediation confirmation.
Workarounds
- Disable public self-service registration if it is not required for site operations
- Place a Web Application Firewall (WAF) rule in front of the registration endpoint to enforce per-IP rate limits
- Add a CAPTCHA or proof-of-work challenge to the registration form to increase enumeration cost
- Return a uniform response for all registration submissions and confirm email uniqueness via a follow-up verification message
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
