CVE-2026-72699 in Login Plugin
Summary
by MITRE • 08/25/2026
The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration. The register() method in classes/Login.php throws a distinct exception (EMAIL_NOT_AVAILABLE) when a submitted email address already belongs to an existing account, while allowing registration to proceed otherwise. Because the registration endpoint has no rate limiting, an attacker can enumerate which email addresses have accounts on the site, one guess per request.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/25/2026
The Grav Login plugin, specifically versions prior to 3.9.1, contains a critical information disclosure vulnerability that allows for the enumeration of registered user email addresses through its registration endpoint. This flaw stems from an inconsistent error handling mechanism within the register method located in classes/Login.php. When a prospective user attempts to create a new account using an email address that is already associated with an existing account on the platform, the system explicitly throws and returns a distinct exception labeled EMAIL_NOT_AVAILABLE. Conversely, if the submitted email address is not currently in use by any other account, the registration process proceeds normally without returning this specific error state. This binary response pattern creates a reliable side channel for attackers to determine whether a given email address exists within the application's database.
The operational impact of this vulnerability extends beyond simple data leakage, as it facilitates targeted social engineering and credential stuffing attacks. By systematically submitting different email addresses to the registration endpoint, an attacker can build a comprehensive list of valid user accounts on the target site. This capability is significantly amplified by the absence of rate limiting mechanisms on the registration API or form submission process. Without constraints on the frequency of requests from a single source IP address or session identifier, automated scripts can rapidly iterate through large volumes of email addresses to map out the organization's digital footprint. The resulting intelligence allows adversaries to focus phishing campaigns and brute-force attacks exclusively on verified accounts, thereby increasing the success rate of subsequent compromise attempts while reducing noise that might trigger security alerts associated with invalid account guesses.
From a classification perspective, this vulnerability aligns closely with CWE-204, which defines observable response discrepancy for an operation performed under different conditions, specifically manifesting here as user enumeration via registration forms. It also maps to the ATT&CK technique T1598.003, known as Phishing for Information within a Host or Service, where attackers gather information about users and their roles by interacting with application interfaces. The lack of rate limiting further exacerbates the risk, relating to CWE-770, which covers insufficient allocation of resources such that an attacker can exhaust them or perform excessive operations without detection.
To mitigate this vulnerability, immediate remediation requires upgrading the Grav Login plugin to version 3.9.1 or later, where the developers have addressed the inconsistent error handling logic. In addition to patching, administrators should implement robust rate limiting policies on all authentication and registration endpoints to prevent automated enumeration attempts regardless of the specific application code behavior. It is also recommended to standardize error responses so that both successful registrations and failures due to existing accounts return identical generic messages, such as "If an account exists for this email address, you will receive a password reset link," thereby removing the observable difference between valid and invalid inputs. Implementing CAPTCHA challenges on registration forms can further deter automated scripts from performing high-volume enumeration attacks effectively.