External risk intelligence

Grav Login Plugin Email Enumeration via Registration.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-72699

The vulnerability affects a registration endpoint within a web application plugin. Registration interfaces are commonly exposed to the public internet to facilitate user account creation, making this surface typically reachable in standard web deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This issue involves a vulnerability in a website login plugin that could allow attackers to discover valid user email addresses by attempting to register new accounts. The system does not limit how many times an attacker can try to register, making it possible to systematically guess and confirm email addresses associated with existing accounts.

Attackers can find user emails.
Protects against unauthorized access.
Confirm plugin relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can begin by sending requests to the plugin's registration endpoint. Since this endpoint lacks rate limiting, the attacker can repeatedly submit different email addresses to identify which ones are already in use on the site. This allows them to build a list of valid user accounts.

No authentication needed.
Submitting an email to register.
Enumerate valid user accounts.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to determine which email addresses are registered on a Grav site. By repeatedly attempting to register new accounts with different email addresses, an attacker can observe distinct error messages that reveal whether an email address is already in use. This information could then be used for targeted attacks or to build lists of valid user accounts.

Registered email addresses.
Unauthenticated requests to registration endpoint.
Targeted attacks against users.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the Grav Login plugin, potentially affecting any Grav-based website using it for user registration. Responsibility for addressing this likely falls to the website's application owner or the platform team managing the Grav installation. The first practical step is to identify all instances of the affected plugin, confirm their exposure and business criticality, and then coordinate remediation with the accountable parties.

Website owners should own this issue.
Verify plugin usage and exposure.
Plan controlled updates or disable registration.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Grav Login plugin?

The Grav Login plugin is an extension for the Grav Content Management System, a flat-file web platform. It adds essential user management capabilities, such as account creation, login authentication, and session handling, allowing site administrators to manage member access and personalize content for their visitors.

What is the vulnerability in CVE-2026-72699?

This vulnerability is an instance of CWE-203, which relates to discrepancies in how a system handles inputs. In this case, the plugin provides different responses depending on whether an email address is already registered. By observing these unique error signals, an attacker can confirm whether a specific email belongs to an account on that site.

How can an attacker trigger this issue?

An attacker triggers this by repeatedly sending registration requests to the site. Because the registration process lacks rate limiting, they can automate thousands of guesses. Requests that do not target an existing email address do not trigger the specific error, allowing the attacker to filter and identify only the valid, registered accounts.

Do I need to worry if my Grav site is not internet-facing?

According to Halo Surface Signal, this vulnerability is particularly relevant for sites where the registration interface is exposed to the public internet to facilitate user onboarding. If your Grav instance is kept on an internal, restricted network, the potential for automated enumeration by external actors is significantly lower, though internal security policies may still apply.

How do I address CVE-2026-72699?

Your first step is to confirm if your environment uses the affected Grav Login plugin version before 3.9.1. Once identified, evaluate if user registration is required for your site's functionality. If it is not strictly necessary, disabling the registration feature is an effective immediate mitigation while you plan to update the plugin to a secure version.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.