CVE-2026-109319: Missing Authorization in getgrav grav-plugin-guestbook

CVE-2026-109319 identifies missing authorization and CSRF vulnerabilities in the Grav Guestbook plugin versions 0.5.0 and 0.5.1. These flaws allow authenticated Admin users lacking the admin.guestbook permission, or external attackers abusing a moderator's session through nonce-less GET requests, to delete or approve Guestbook entries without proper authorization checks. The affected actions include delete, approve, and approveAll within the Admin moderation interface.

Unauthorized deletion or approval of Guestbook entries can occur due to missing authorization checks and CSRF vulnerabilities. This could lead to manipulation of guestbook content by unauthorized users or external attackers leveraging a moderator's session. The impact is limited to modification of guestbook entries and does not include privilege escalation or broader system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to Admin users with proper permissions and avoid using the affected plugin versions 0.5.0 and 0.5.1 if possible. Implement additional CSRF protections and session management best practices to reduce risk.