All vulnerabilities
CVE-2026-109323GHSA-556j-6jh2-5rcv

grav-plugin-star-ratings: Grav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote_access Authorization

getgrav grav-plugin-star-ratings
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 16% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.0.4Fixed versionCVE List
Published12 Oct 2026Updated 13 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only vote_access and readonly enforcement. Attackers can use the anonymous nonce emitted by getData() to submit votes directly to addVote(), manipulating restricted or disabled ratings and aggregate rating output.

Text from CVE List

Affected versions 2

  • grav-plugin-star-ratingsaffected: 2.0.1 before 2.0.4CVE List
  • grav-plugin-star-ratingsunaffected: 2.0.4CVE List

References 2