CVE-2026-86194: Grav Form Plugin Auth Bypass Vulnerability

CVE-2026-86194 Overview

CVE-2026-86194 is a missing authorization vulnerability [CWE-862] in the Grav Form Plugin before version 9.1.22. The plugin resolves forms by name across pages without verifying whether the requesting user has authorization to access the parent page. Anonymous visitors can POST to any public page using a form name defined on a login-restricted or unpublished page. This triggers form actions such as save, upload, email, or call without authentication.

Critical Impact
Unauthenticated attackers can invoke restricted form actions on protected or unpublished pages, bypassing access controls entirely.

Affected Products

Grav CMS Form Plugin versions prior to 9.1.22
Grav sites that define forms on login-restricted pages
Grav sites that define forms on unpublished pages

Discovery Timeline

2026-09-05 - CVE-2026-86194 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86194

Vulnerability Analysis

The Grav Form Plugin exposes form definitions through a name-based lookup that spans the entire site. When a POST request references a form by name, the plugin loads and executes the matching form regardless of which page received the request. The plugin does not check whether the caller is authorized to view the page that originally defined the form.

An attacker who identifies a form name defined on a restricted page can submit that form through any public endpoint. The plugin executes the associated actions with the privileges implied by the form's definition. This turns page-level access control into a purely cosmetic boundary for form functionality.

Root Cause

The root cause is missing authorization enforcement during cross-page form resolution. The plugin trusts the form name supplied by the client and does not re-evaluate the ACL of the source page. Access checks apply only to page rendering, not to form action dispatch.

Attack Vector

Exploitation requires network access to any public page on the target Grav site. The attacker crafts an HTTP POST containing the target form's name and required fields. The request executes actions defined on the restricted or unpublished page, including writing files through save, uploading content through upload, sending messages through email, or invoking server-side handlers through call.

Refer to the GitHub Security Advisory GHSA-33m4-m988-5fvh and the VulnCheck Advisory for Grav Plugin for the vendor description of the flaw.

Detection Methods for CVE-2026-86194

Indicators of Compromise

POST requests to public Grav pages containing form field names that belong to restricted or unpublished pages
Unexpected files written to upload directories by unauthenticated sessions
Outbound email originating from Grav Form email actions without a corresponding authenticated session
New or modified data files in Grav form storage directories tied to anonymous requests

Detection Strategies

Compare form names present in POST bodies against the ACL scope of the receiving page and alert on mismatches
Correlate anonymous session activity with executions of save, upload, email, or call form actions
Baseline expected form submissions per page and flag submissions that reference forms not declared on that page

Monitoring Recommendations

Enable verbose access logging on the Grav web server and forward logs to a centralized analytics platform
Monitor the Grav user/data/ and upload directories for file creation events from web-server processes
Alert on outbound SMTP traffic volumes from the Grav host that deviate from baseline

How to Mitigate CVE-2026-86194

Immediate Actions Required

Upgrade the Grav Form Plugin to version 9.1.22 or later on all Grav installations
Audit forms defined on login-restricted or unpublished pages and identify any that were exposed prior to patching
Review upload directories, form data stores, and mail logs for evidence of unauthorized submissions
Rotate credentials or tokens that may have been transmitted through affected form actions

Patch Information

The maintainers fixed the flaw in Grav Form Plugin version 9.1.22. The update enforces authorization checks on the page that defines the form during cross-page resolution. Consult the GitHub Security Advisory GHSA-33m4-m988-5fvh for release notes and upgrade guidance.

Workarounds

Remove or rename forms defined on restricted or unpublished pages until the plugin is upgraded
Move sensitive form actions to a separate Grav instance that is not reachable by anonymous users
Restrict POST requests to Grav pages behind an authenticating reverse proxy where feasible

bash

# Upgrade the Grav Form plugin using the Grav GPM CLI
bin/gpm update form

# Verify the installed version is 9.1.22 or later
bin/gpm info form