CVE-2026-72699 Grav Login Plugin before 3.9.1 Email Enumeration via Registration
Attackers can enumerate registered email addresses on Grav sites due to distinct error messages during registration, exposing user data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-72699?
CVE-2026-72699 is a critical vulnerability in getgrav grav-plugin-login, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration. The register() method in classes/Login.php throws a distinct exception (EMAIL_NOT_AVAILABLE) when a submitted email address already belongs to an existing account, while allowing registration to proceed otherwise. Because the registration endpoint has no rate limiting, an attacker can enumerate which email addresses have accounts on the site, one guess per request.
Weakness: CWE-203
Which versions are affected by CVE-2026-72699?
How do I fix CVE-2026-72699?
No fix has been published for CVE-2026-72699 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-72699 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-72699 exists.
Sources
Also known as GHSA-55hc-4r2f-h6wr.