---
id: CVE-2026-72699
title: >-
  The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable
  to email address enumeration
summary: >-
  The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable
  to email address enumeration. The register() method in classes/Login.php
  throws a distinct exception (EMAIL_NOT_AVAILABLE) when a submitted email
  address alread…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-203
published: '2026-08-25'
updated: '2026-08-29'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72699'
references:
  - url: 'https://github.com/getgrav/grav/security/advisories/GHSA-crh8-xm27-j9g9'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/grav-login-plugin-before-email-enumeration-via-registration
    label: disclosure@vulncheck.com
  - url: 'https://github.com/getgrav/grav/security/advisories/GHSA-crh8-xm27-j9g9'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00343
epssPercentile: 0.25106
ingestedAt: '2026-08-29T21:42:33.364Z'
---

## Overview

The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration. The register() method in classes/Login.php throws a distinct exception (EMAIL_NOT_AVAILABLE) when a submitted email address already belongs to an existing account, while allowing registration to proceed otherwise. Because the registration endpoint has no rate limiting, an attacker can enumerate which email addresses have accounts on the site, one guess per request.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.