CVE-2026-109323

Name of the Vulnerable Software and Affected Versions Grav Star Ratings versions 2.0.1 through 2.0.3

Description Missing authorization allows unauthenticated visitors to cast votes by bypassing client-side vote access and readonly enforcement. An attacker can utilize the anonymous nonce provided by the getData() function to submit votes directly to the addVote() function, enabling the manipulation of restricted or disabled ratings and the resulting aggregate rating output.

Recommendations Update Grav Star Ratings to a version later than 2.0.3.