CVE-2026-56709 describes a security flaw in Grav prior to version 3.9.2 where the sendInvitationEmail() function relies on reverse DNS resolution and fails to validate untrusted Host headers when constructing token-bearing invitation links. This enables an attacker to manipulate the Host header to poison invitation links, redirecting users to malicious domains. The existing require_trusted_host protection mechanism does not cover invitation links, only password reset flows, leaving this attack vector unprotected.

An attacker can craft invitation links with manipulated Host headers that redirect recipients to attacker-controlled domains. This can lead to phishing or other social engineering attacks leveraging the trusted appearance of invitation emails. The vulnerability does not require authentication or user interaction beyond clicking the link. However, no known exploits are reported in the wild at this time.

No official patch or remediation level has been published yet. Users should monitor the vendor advisory for updates and apply any official fixes once available. Until then, avoid exposing the affected functionality to untrusted input or consider implementing additional validation on Host headers in invitation links.