Is CVE-2026-109323 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109323 being exploited in the wild.

How severe is CVE-2026-109323?

Medium severity, with a CVSS score of 5.3, published 12 October 2026.

Which products and versions are affected?

Getgrav Star Ratings 2.0.1 through 2.0.3.

How is CVE-2026-109323 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-109323?

Check whether you run Getgrav Star Ratings at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109323: Grav Star Ratings missing server-side authorization in vote handler

CVE-2026-109323 · Severity: medium · CVSS 5.3 · Published 2026-10-12

Grav Star Ratings is a plugin that allows website visitors to rate content using a star widget. The plugin exposes settings to restrict voting to authorized users or disable voting entirely, but these restrictions are only enforced by the browser interface. An attacker can bypass this UI restriction and submit votes directly to the server, allowing them to manipulate ratings on sites where an administrator explicitly restricted voting permissions.

Vendors: Getgrav.

Quick answers

Is CVE-2026-109323 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109323 being exploited in the wild.
How severe is CVE-2026-109323?: Medium severity, with a CVSS score of 5.3, published 12 October 2026.
Which products and versions are affected?: Getgrav Star Ratings 2.0.1 through 2.0.3.
Is there a fix for CVE-2026-109323?: Yes: fixed in Star Ratings 2.0.4. Until then: The fix enforces vote_access and readonly settings in the server-side addVote() handler before accepting votes. Note that per-page vote_access and per-widget readOnly passed to the stars() function are not yet bound to the server-side callback in the patched version, so only global configuration restrictions are enforced. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109323 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-109323?: Check whether you run Getgrav Star Ratings at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Star Ratings 2.0.4

The fix enforces vote_access and readonly settings in the server-side addVote() handler before accepting votes. Note that per-page vote_access and per-widget readOnly passed to the stars() function are not yet bound to the server-side callback in the patched version, so only global configuration restrictions are enforced.

Technical details

The vulnerability is a missing authorization check (CWE-862) in the server-side addVote() handler. The getData() method checks vote_access permissions and emits client-side UI flags, but still generates a valid anonymous nonce for all visitors. An attacker can ignore the readonly or loginRequired UI flags and submit the nonce directly to addVote(), which validates only the nonce and optional per-IP deduplication but never re-authorizes against vote_access or readonly settings. Attack vector is network with no privileges required or user interaction needed.

Affected products

getgrav Star Ratings 2.0.1 through 2.0.3

Timeline

2026-09-23: disclosed
2026-10-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.