Medium severity · published Aug 25, 2026
CVE-2026-72699
Grav Login Plugin before 3.9.1 Email Enumeration via Registration
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration. The register() method in classes/Login.php throws a distinct exception (EMAIL_NOT_AVAILABLE) when a submitted email address already belongs to an existing account, while allowing registration to proceed otherwise. Because the registration endpoint has no rate limiting, an attacker can enumerate which email addresses have accounts on the site, one guess per request.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
grav-plugin-login · getgrav
before 3.9.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-72699
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-72699
github.com
https://github.com/getgrav/grav/security/advisories/GHSA-crh8-xm27-j9g9
www.vulncheck.com
https://www.vulncheck.com/advisories/grav-login-plugin-before-email-enumeration-via-registration
More from grav-plugin-login
8.8
CVE-2026-114658
Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite
8.1
CVE-2026-109313
Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie
8.1
CVE-2026-109312
Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form
7.4
CVE-2026-62669
Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge
7.3
CVE-2026-109314
Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page