CVE-2026-72699CWE-203

CVE-2026-72699

Medium · published August 25, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
16.4
In the wild
Unconfirmed
What it is

The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration. The register() method in classes/Login.php throws a distinct exception (EMAIL_NOT_AVAILABLE) when a submitted email address already belongs to an existing account, while allowing registration to proceed otherwise. Because the registration endpoint has no rate limiting, an attacker can enumerate which email addresses have accounts on the site, one guess per request.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00257 · 16.4th percentile
Weakness
CWE-203 · Observable Discrepancy
Published
2026-08-25T06:16Z
References (3)
https://github.com/getgrav/grav/security/advisories/GHSA-crh8-xm27-j9g9 · [email protected]https://www.vulncheck.com/advisories/grav-login-plugin-before-email-enumeration-via-registration · [email protected]https://github.com/getgrav/grav/security/advisories/GHSA-crh8-xm27-j9g9 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 26 AUG 08:25Z
    EPSS moved — → 0%
    epss
  • 25 AUG 01:30Z
    Grav Login Plugin before 3.9.1 Email Enumeration via Registration
    cvelistv5