Read the docs
TI-2026-71139 Aliases CVE-2026-109323GHSA-pwp7-4hgc-rjhr

Missing authorization in Grav Star Ratings lets visitors vote

Priority LOW 36CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Grav Star Ratings from 2.0.1 before 2.0.4 is missing server-side authorization checks on voting. Unauthenticated visitors can submit votes by bypassing the client-only vote_access and readonly restrictions, using the anonymous nonce that getData() emits to call addVote() directly. An attacker can therefore manipulate restricted or disabled ratings and the aggregate rating output, which is tracked as CWE-862.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only vote_access and readonly enforcement. Attackers can use the anonymous nonce emitted by getData() to submit votes directly to addVote(), manipulating restricted or disabled ratings and aggregate rating output.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0026 17th percentileScored 2026-11-07
Fix Fixed grav-plugin-star-ratings (getgrav): 2.0.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
getgravgrav-plugin-star-ratings2.0.1 to before 2.0.42.0.4Patch availableCNA
  • grav-plugin-star-ratings Vendorgetgrav Affected 2.0.1 to before 2.0.4 Fixed in 2.0.4 Patch available CNA

Remediation

Update the grav-plugin-star-ratings package to version 2.0.4, which is the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA grav-plugin-star-ratings (getgrav) Fixed in 2.0.4

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-109323
  2. 2026-10-12 Alias added: GHSA-pwp7-4hgc-rjhr
  3. 2026-10-13 CISA SSVC decision points changed
  4. 2026-10-13 Priority changed: MEDIUM → LOW

References

Advisory 1

  • TI-2026-30893 Grav: Privilege Escalation via Missing Server-Side Validation of groups/access CVSS 3.1CRITICAL 9.4
  • TI-2025-28971 Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to… CVSS 3.1CRITICAL 9.8
  • TI-2021-04523 Unauthenticated Arbitrary YAML Write/Update leads to Code Execution CVSS 3.1CRITICAL 9.8
  • TI-2026-50940 Grav CMS before 2.0.16 Origin Validation Bypass via Referer CVSS 4.0CRITICAL 9.3
  • TI-2026-46446 Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData CVSS 4.0CRITICAL 9.3
  • TI-2021-22428 GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2) CVSS 4.0CRITICAL 9.3
See all 228 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences