← Vulnerability feed

Vulnerability record · CVE-2026-56709 · published 25 August 2026

CVE-2026-56709: Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when construc…

Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled domains, bypassing the require_trusted_host protection which only covers password reset flows.

8.7 CVSS 4.0 High EPSS 0.43% · top 64.8% CWE-350 · CWE-350 Deferred
8.7CVSS 4.0 base score
0.43%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
2References
31 Aug 2026Last modified by NVD

Description

Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled domains, bypassing the require_trusted_host protection which only covers password reset flows.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

References

LinkTags
https://github.com/getgrav/grav/security/advisories/GHSA-69vf-mjxw-x79j
https://www.vulncheck.com/advisories/grav-before-host-header-injection-via-sendinvitationemail

Track CVE-2026-56709 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Source: NIST National Vulnerability Database (record CVE-2026-56709), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.