Is CVE-2026-56709 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56709 being exploited in the wild.

How severe is CVE-2026-56709?

High severity, with a CVSS score of 7.5, published 25 August 2026.

Is there a fix for CVE-2026-56709?

A patch was published on 2026-08-25: Version 3.9.2 patches the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56709 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-56709?

Check whether you run Grav at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56709: Grav Host header injection in sendInvitationEmail

CVE-2026-56709 · Severity: high · CVSS 7.5 · Published 2026-08-25

Grav, a flat-file CMS, contains a vulnerability in its user invitation feature that allows attackers to manipulate email invitation links by poisoning the Host header. An attacker can redirect users to malicious sites by crafting fraudulent invitations, potentially compromising user accounts. The vulnerability bypasses the intended security protection that administrators enable to prevent such attacks.

Technologies: Grav. Vendors: Grav.

Quick answers

Is CVE-2026-56709 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56709 being exploited in the wild.
How severe is CVE-2026-56709?: High severity, with a CVSS score of 7.5, published 25 August 2026.
Which products and versions are affected?: Grav before 3.9.2.
Is there a fix for CVE-2026-56709?: A patch was published on 2026-08-25: Version 3.9.2 patches the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56709 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-56709?: Check whether you run Grav at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The sendInvitationEmail() function in classes/Email.php constructs token-bearing invitation links using Utils::url() but fails to call warnIfUntrustedHost(), a validation mechanism present in three similar security-sensitive email functions (sendActivationEmail, sendResetPasswordEmail, sendMagicLoginEmail). An attacker can inject a malicious Host header (e.g., via HTTP request manipulation or network interception) that is used to construct the invitation URL, allowing link poisoning without warning or enforcement. Additionally, the require_trusted_host configuration option only enforces validation for password reset flows, not invitations, leaving the invitation endpoint unprotected even when the setting is enabled. The vulnerability affects Grav versions before 3.9.2 and was patched in 3.9.2.

Affected products

Grav Grav before 3.9.2

Timeline

2026-08-25: disclosed
2026-08-25: patched: Version 3.9.2 patches the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.