CVE-2026-109316: Missing Authorization in getgrav grav-plugin-data-manager

CVE-2026-109316 describes a missing authorization vulnerability in the Grav Data Manager plugin versions 1.4.0 through 1.4.5. The vulnerability permits unauthenticated attackers to delete stored data files by sending requests containing a delete parameter along with known data type and filename. The issue arises due to lack of authorization enforcement and absence of CSRF nonce validation in the classic Admin integration, enabling attackers to remove files under the user/data/ directory, including form submissions.

An attacker without authentication can delete stored data files, potentially causing data loss or disruption of services relying on these files. The vulnerability does not require user interaction or privileges and does not involve confidentiality or integrity of data beyond deletion. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Admin interface and user/data/ directory to trusted users only. Monitor for suspicious requests attempting to delete data files. Implement additional access controls or web application firewall rules to block unauthorized delete requests if possible.