Executive brief
Grav, a flat-file CMS, contains a vulnerability in its user invitation feature that allows attackers to manipulate email invitation links by poisoning the Host header. An attacker can redirect users to malicious sites by crafting fraudulent invitations, potentially compromising user accounts. The vulnerability bypasses the intended security protection that administrators enable to prevent such attacks.
Technical details
The sendInvitationEmail() function in classes/Email.php constructs token-bearing invitation links using Utils::url() but fails to call warnIfUntrustedHost(), a validation mechanism present in three similar security-sensitive email functions (sendActivationEmail, sendResetPasswordEmail, sendMagicLoginEmail). An attacker can inject a malicious Host header (e.g., via HTTP request manipulation or network interception) that is used to construct the invitation URL, allowing link poisoning without warning or enforcement. Additionally, the require_trusted_host configuration option only enforces validation for password reset flows, not invitations, leaving the invitation endpoint unprotected even when the setting is enabled. The vulnerability affects Grav versions before 3.9.2 and was patched in 3.9.2.
Affected products
- Grav Grav before 3.9.2
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Version 3.9.2 patches the vulnerability