CVE-2026-109323

Executive Summary

CVE-2026-109323 is a missing authorization vulnerability in the Grav Star Ratings plugin (versions 2.0.1 through 2.0.3) that allows unauthenticated visitors to cast votes on restricted or disabled ratings. The flaw stems from client-side-only enforcement of vote_access and readonly controls, which can be bypassed by submitting votes directly to the addVote() function using the anonymous nonce exposed by getData(). Successful exploitation manipulates aggregate rating output and potentially distorts site content integrity, though the CVSS impact is limited to integrity (5.3 Medium). No public exploit or patch currently exists.

Technical Analysis

Grav is a flat-file content management system (CMS) written in PHP. The Star Ratings plugin adds voting functionality to content items. In affected versions (2.0.1–2.0.3), the plugin relies on client-side JavaScript to enforce two access control parameters: vote_access (which determines whether voting is permitted for a given user or context) and readonly (which disables voting entirely for certain content). These constraints are not validated server-side within the addVote() endpoint.

The vulnerability class is CWE-862 (Missing Authorization), meaning the application does not perform an authorization check before allowing a state-changing action. The getData() function emits an anonymous nonce to unauthenticated visitors, likely intended to associate votes with a session or prevent CSRF. However, because the nonce is made available without any authentication or authorization gate, an attacker can retrieve it and then craft a direct request to the addVote() endpoint. The server accepts the vote regardless of vote_access or readonly settings, as those are only checked in the browser.

This is a classic case of client-side security control bypass. The attack surface is the public-facing HTTP endpoint that processes votes. Any visitor—authenticated or not—can obtain the nonce and submit arbitrary votes, manipulating rating values and aggregate output (e.g., average star rating, total vote count). The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates a network-accessible, low-complexity attack requiring no privileges or user interaction, with only low integrity impact and no confidentiality or availability impact.

No code-level details (e.g., exact file paths, function implementations, HTTP parameter names) are provided in the NVD description beyond the function names getData() and addVote(). Therefore, further technical specifics cannot be confirmed without source code review.

Exploitation Scenarios

1. Reconnaissance/target identification: An attacker identifies a Grav-powered website using the Star Ratings plugin version 2.0.1–2.0.3. This can be done via Shodan dorks (e.g., http.html:"Grav") or manual inspection of the site's plugin directory. The attacker locates a page with a rating widget.

2. Triggering the flaw class: The attacker accesses the page and observes the client-side JavaScript that calls getData(). This function returns an anonymous nonce, which is embedded in the page source or returned via an AJAX response. The attacker captures this nonce. Because vote_access and readonly are enforced only in the browser, the attacker can ignore those settings.

3. Payload/execution method (vulnerability-class level): Using the obtained nonce, the attacker crafts a direct HTTP request to the addVote() endpoint (likely a POST request with parameters such as the nonce, content ID, and vote value). The server processes the vote without verifying whether the user is authorized or whether the rating is marked read-only. No public PoC is available; the attack chain is inferred from the vulnerability class (missing authorization) and the function names disclosed.

4. Post-exploitation impact: The attacker can submit multiple votes, skewing the aggregate rating for targeted content. This can manipulate user perception, artificially inflate or deflate ratings, and potentially disrupt site trust. The CVSS integrity impact is Low, meaning the attacker can modify some data but not critically. There is no confidentiality or availability impact. The attack is repeatable and can be automated.

Impact Assessment

The business impact is primarily reputational and integrity-related. Websites relying on Grav Star Ratings for user feedback (e.g., product reviews, article ratings) may present manipulated aggregate scores, misleading visitors and damaging trust. The blast radius is limited to sites running the vulnerable plugin versions 2.0.1–2.0.3. Since the vulnerability requires no authentication, any internet-facing instance is exposed. The CVSS score of 5.3 (Medium) reflects low integrity impact only; confidentiality and availability are unaffected. There is no evidence of active exploitation in the wild, and no CISA KEV listing.

Detection Guidance

Sigma Rule

title: Grav Star Ratings Missing Authorization - Unauthenticated Voting
id: 8f3a1c2e-5b7d-4e9f-8a1b-2c3d4e5f6a7b
status: experimental
description: Detects attempts to exploit CVE-2026-109323 by submitting votes to addVote() with an anonymous nonce, bypassing client-side vote_access and readonly.
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: apache
  service: access_combined
detection:
  selection:
    cs-method: 'POST'
    cs-uri-query|contains:
      - 'addVote'
      - 'getData'
    sc-status: 200
  condition: selection
falsepositives:
  - Legitimate voting by authorized users
level: medium
tags:
  - attack.t1190
  - cve.2026.109323

YARA Rule

rule CVE_2026_109323_Grav_Star_Ratings_Missing_Authorization
{
    meta:
        description = "Detects PHP source code or HTTP traffic referencing vulnerable Grav Star Ratings functions getData() and addVote() with missing authorization checks."
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109323"
        cve = "CVE-2026-109323"
    strings:
        $func1 = "getData()" ascii wide nocase
        $func2 = "addVote()" ascii wide nocase
        $param1 = "vote_access" ascii wide nocase
        $param2 = "readonly" ascii wide nocase
    condition:
        (uint16(0) == 0x3C3F or uint16(0) == 0x3C21) and
        (any of ($func*)) and (any of ($param*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109323 Grav Star Ratings Unauthenticated Vote Manipulation Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"addVote"; http.uri; content:"nonce"; classtype:attempted-recon; sid:10000001; rev:1; reference:cve,2026-109323;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [http where http.request.method == "GET" and url.path contains "getData" and http.response.status_code == 200]
  [http where http.request.method == "POST" and url.path contains "addVote" and http.response.status_code == 200]

Splunk SPL Query

index=web sourcetype=access_combined
| search method=POST uri_path="*addVote*" status=200
| rex field=uri_query "nonce=(?<nonce>[^&]+)"
| where isnotnull(nonce)
| stats count by clientip, uri_path, nonce
| where count > 1

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="100200" level="7">
    <if_sid>31100</if_sid>
    <url>addVote</url>
    <method>POST</method>
    <description>CVE-2026-109323: Possible Grav Star Ratings unauthenticated vote manipulation attempt (addVote with nonce)</description>
    <group>cve_2026_109323,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

Immediate mitigations:

• Disable the Star Ratings plugin entirely until a patched version is available.
• If the plugin must remain active, implement server-side authorization checks for the addVote() endpoint, ensuring that vote_access and readonly are enforced on the server, not just client-side.
• Restrict access to the addVote() endpoint via a web application firewall (WAF) rule that validates user roles or blocks unauthenticated POST requests containing anonymous nonces.
• Monitor access logs for repeated POST requests to addVote() with the same nonce or from the same IP, which may indicate abuse.

Patch/upgrade steps: No vendor patch is currently available. Monitor the Grav Star Ratings plugin repository and Grav CMS security advisories for an update. Once a patched version is released, upgrade immediately. If the plugin is abandoned, consider replacing it with an alternative ratings solution that enforces server-side authorization.

Long-term hardening:

• Enforce all access control decisions server-side, especially for state-changing operations.
• Treat client-side nonces as CSRF tokens only, not as authorization mechanisms; validate user permissions independently.
• Implement rate limiting and CAPTCHA on voting endpoints to deter automated abuse.
• Conduct regular security reviews of third-party plugins for missing authorization (CWE-862) issues.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109323
• CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
• Grav CMS Official Site: https://getgrav.org/
• Grav Star Ratings Plugin Repository (monitor for updates): https://github.com/getgrav/grav-plugin-star-ratings
• MITRE ATT&CK T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/

No public exploit, PoC, or evidence of active exploitation in the wild is currently available. No threat actor campaigns have been associated with this CVE.