CVE-2026-86194— Grav Form Plugin before 9.1.22 Cross-Page Form Execution
Quick assessment
Affected
getgrav grav-plugin-form
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Grav Form 插件在 9.1.22 之前的版本中，在跨页面按名称解析表单时未能验证页面授权，使得匿名用户能够执行定义在需要登录或尚未发布页面上的表单动作。攻击者可以向任何包含受限表单名称的公开页面发送 POST 请求，从而无需身份验证即可触发保存、上传、发送邮件或调用等动作。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| getgrav | grav-plugin-form | < 9.1.22 |
affected |
9.1.22 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86194
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Grav Form Plugin before 9.1.22 Cross-Page Form Execution
Source: CVE Program / CVE List V5
Vulnerability Description
Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form's name to trigger save, upload, email, or call actions without authentication.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| getgrav | grav-plugin-form | 0 ~ 9.1.22 | - |
|
II. Public POCs for CVE-2026-86194
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86194
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-86194 (2)
-
-
🔗 Grav Form Plugin before 9.1.22 Cross-Page Form Execution | Advisories | VulnCheck third-party-advisory
Same Patch Batch · getgrav · 2026-09-05 · 5 CVEs total
| CVE-2026-86196 | 8.7 HIGH | Grav API Plugin before 1.0.20 Authentication Bypass via Host Header |
| CVE-2026-86195 | 8.7 HIGH | grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag |
| CVE-2026-86193 | 8.7 HIGH | Grav API Plugin Authentication Bypass via Group-Inherited Super |
| CVE-2026-86197 | 5.1 MEDIUM | Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox |
IV. Related Vulnerabilities
Same vendor: getgrav
-
CVE-2026-86197
Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox -
CVE-2026-86195
grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation vi -
CVE-2026-86196
Grav API Plugin before 1.0.20 Authentication Bypass via Host -
CVE-2026-86193
Grav API Plugin Authentication Bypass via Group-Inherited Su -
CVE-2026-85603
Grav Admin Plugin Path Traversal via Save As Language Code
Same weakness: CWE-862
-
CVE-2026-15550
Ninja Forms - Save Progress <= 3.0.30 - Missing Authorizatio -
CVE-2025-9049
Nokri – Job Board WordPress Theme <= 1.6.4 - Missing Authori -
CVE-2026-12843
LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Cou -
CVE-2026-86178
Pixelfed through 0.12.9 Unauthorized Story Access via API -
CVE-2026-86177
Pterodactyl Panel before 1.14.1 Privilege Escalation via Sch
V. Comments for CVE-2026-86194
No comments yet