CVE-2026-72699: fallo crítico en getgrav grav-plugin-login
Grav Login Plugin before 3.9.1 Email Enumeration via Registration
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.3epss 0.3%
The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration. The register() method in classes/Login.php throws a distinct exception (EMAIL_NOT_AVAILABLE) when a submitted email address already belongs to an existing account, while allowing registration to proceed otherwise. Because the registration endpoint has no rate limiting, an attacker can enumerate which email addresses have accounts on the site, one guess per request.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
getgrav · grav-plugin-loginCVEs relacionadas — getgrav grav-plugin-login
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-62669HIGHGrav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending ChallengeEPSS 0.5%CVE-2026-109313HIGHGrav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me CookieEPSS 0.4%CVE-2026-109312HIGHGrav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update FormEPSS 0.4%CVE-2026-109314HIGHGrav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset PageEPSS 0.3%CVE-2026-114658HIGHGrav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.inviteEPSS 0.3%CVE-2026-62671MEDIUMCSRF in grav-plugin-login: anonymous attacker rotates a logged-in user's 2FA (TOTP) secret (no nonce on task=login.regenerate2FASecret)EPSS 0.2%