Executive brief
The Grav Form Plugin is a component that handles form submissions on Grav CMS websites. The plugin fails to verify whether a user has permission to access restricted or unpublished pages when a form is submitted. An unauthenticated attacker can exploit this by posting form data to any public page with a restricted form's name, allowing them to trigger actions like saving data, uploading files, or sending emails that were intended only for logged-in users.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the Form plugin's form resolution mechanism. When a form POST cannot be matched to a form on the submitted page, the plugin falls back to findFormByName(), which searches all pages site-wide for a matching form by name. This fallback retrieves the form from the owning page without verifying that page's publish status or access control rules. An unauthenticated visitor can obtain a valid CSRF token anonymously via the get-nonce endpoint, then POST to any public page with __form-name__ set to a restricted form's name to trigger its actions (save, upload, email, call). The owning page's access rules are never evaluated against the attacker's session. Patches are available in version 9.1.22 and later.
Affected products
- Grav Form Plugin before 9.1.22
Timeline
- 2026-08-21: disclosed
- 2026-09-05: patched: Patched in Form Plugin 9.1.22