CVE-2026-72699: critical vulnerability in getgrav grav-plugin-login
Grav Login Plugin before 3.9.1 Email Enumeration via Registration
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.3epss 0.3%
The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration. The register() method in classes/Login.php throws a distinct exception (EMAIL_NOT_AVAILABLE) when a submitted email address already belongs to an existing account, while allowing registration to proceed otherwise. Because the registration endpoint has no rate limiting, an attacker can enumerate which email addresses have accounts on the site, one guess per request.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
getgrav · grav-plugin-loginRelated CVEs — getgrav grav-plugin-login
In the same product, most dangerous first.
CVE-2026-62669HIGHGrav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending ChallengeEPSS 0.5%CVE-2026-109313HIGHGrav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me CookieEPSS 0.4%CVE-2026-109312HIGHGrav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update FormEPSS 0.4%CVE-2026-109314HIGHGrav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset PageEPSS 0.3%CVE-2026-114658HIGHGrav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.inviteEPSS 0.3%CVE-2026-62671MEDIUMCSRF in grav-plugin-login: anonymous attacker rotates a logged-in user's 2FA (TOTP) secret (no nonce on task=login.regenerate2FASecret)EPSS 0.2%