# CVE-2026-86194: Grav Form Plugin authorization bypass in cross-page form resolution

Source: https://junglewise.ai/threats/cve-2026-86194-grav-form-plugin-authorization-bypass-in-cross-page-form  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-05. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86194 · Severity: info · CVSS 6.9 · Published 2026-09-05

The Grav Form Plugin is a component that handles form submissions on Grav CMS websites. The plugin fails to verify whether a user has permission to access restricted or unpublished pages when a form is submitted. An unauthenticated attacker can exploit this by posting form data to any public page with a restricted form's name, allowing them to trigger actions like saving data, uploading files, or sending emails that were intended only for logged-in users.

Technologies: [Grav Form Plugin](https://junglewise.ai/threats/technologies/form-plugin). Vendors: [Grav](https://junglewise.ai/threats/vendors/grav).

## Quick answers

**Is CVE-2026-86194 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86194 being exploited in the wild.

**How severe is CVE-2026-86194?** Informational severity, with a CVSS score of 6.9, published 5 September 2026.

**Which products and versions are affected?** Grav Form Plugin before 9.1.22.

**Is there a fix for CVE-2026-86194?** A patch was published on 2026-09-05: Patched in Form Plugin 9.1.22 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86194 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-86194?** Check whether you run Grav Form Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authorization check (CWE-862) in the Form plugin's form resolution mechanism. When a form POST cannot be matched to a form on the submitted page, the plugin falls back to findFormByName(), which searches all pages site-wide for a matching form by name. This fallback retrieves the form from the owning page without verifying that page's publish status or access control rules. An unauthenticated visitor can obtain a valid CSRF token anonymously via the get-nonce endpoint, then POST to any public page with __form-name__ set to a restricted form's name to trigger its actions (save, upload, email, call). The owning page's access rules are never evaluated against the attacker's session. Patches are available in version 9.1.22 and later.

## Affected products

- Grav Form Plugin before 9.1.22

## Timeline

- 2026-08-21: disclosed
- 2026-09-05: patched: Patched in Form Plugin 9.1.22

## References

- [https://github.com/getgrav/grav/security/advisories/GHSA-33m4-m988-5fvh](https://github.com/getgrav/grav/security/advisories/GHSA-33m4-m988-5fvh)
- [https://www.vulncheck.com/advisories/grav-form-plugin-before-9.1.22-cross-page-form-execution](https://www.vulncheck.com/advisories/grav-form-plugin-before-9.1.22-cross-page-form-execution)

## Related threats

- [Grav Form plugin arbitrary file write via Twig-processed filename](https://junglewise.ai/threats/cve-2026-61873-grav-form-plugin-arbitrary-file-write-via-twig-processed-filename)
- [Grav Form Plugin unauthenticated page-content overwrite via file upload](https://junglewise.ai/threats/cve-2026-42845-grav-form-plugin-unauthenticated-page-content-overwrite-via-file)
- [Grav Form Plugin Stored XSS in select field template](https://junglewise.ai/threats/cve-2026-42842-grav-form-plugin-stored-xss-in-select-field-template)