CVE-2026-72699

Name of the Vulnerable Software and Affected Versions Grav Login plugin versions prior to 3.9.1

Description An issue exists where the registration endpoint allows for email address enumeration. The register() function in classes/Login.php triggers a specific exception, EMAIL NOT AVAILABLE, when a provided email address is already associated with an account, whereas other attempts allow the process to continue. Due to the absence of rate limiting on the registration endpoint, an attacker can systematically identify registered email addresses by submitting requests individually.

Recommendations Update Grav Login plugin to version 3.9.1 or later.