CVE-2026-86194CWE-862broken-access-control

CVE-2026-86194

published September 5, 2026

CVSS
6.9
EPSS
1%
Percentile
46.1
In the wild
Unconfirmed
What it is

Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form's name to trigger save, upload, email, or call actions without authentication.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00564 · 46.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-05T17:18Z
References (2)
https://github.com/getgrav/grav/security/advisories/GHSA-33m4-m988-5fvh · [email protected]https://www.vulncheck.com/advisories/grav-form-plugin-before-9.1.22-cross-page-form-execution · [email protected]
EPSS history
Timeline
  • 07 SEP 03:36Z
    EPSS moved — → 0%
    epss
  • 05 SEP 12:09Z
    Grav Form Plugin before 9.1.22 Cross-Page Form Execution
    cvelistv5