CVE-2026-72699: Observable Discrepancy in getgrav grav-plugin-login

CVE-2026-72699 affects the Grav Login plugin (getgrav/grav-plugin-login) versions prior to 3.9.1. The vulnerability arises because the register() method in classes/Login.php throws a specific exception (EMAIL_NOT_AVAILABLE) when a submitted email address is already associated with an account. This behavior differs from the response when the email is not registered, enabling attackers to enumerate valid email addresses on the site. The registration endpoint lacks rate limiting, which facilitates automated enumeration attacks by allowing one guess per request without restriction.

An attacker can determine which email addresses have accounts on a vulnerable Grav site by submitting registration requests and observing the distinct error responses. This information disclosure can aid in targeted phishing, social engineering, or brute force attacks. The lack of rate limiting exacerbates the risk by allowing rapid enumeration attempts. There is no indication of direct account compromise or privilege escalation from this vulnerability alone.

No official patch or remediation level is currently stated. Users should monitor the vendor advisory for updates and apply any official fixes once available. In the meantime, implementing rate limiting on the registration endpoint and standardizing error messages to avoid revealing account existence can mitigate the risk.