🚨 CVE-2026-86194
Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form's name to trigger save, upload, email, or call actions without authentication.
🎖@cveNotify
GitHub
Cross-page form resolution runs a restricted page's form actions for anonymous visitors
### Summary
When a form POST cannot be resolved to a form on the page being posted to, `FormPlugin::getForm()` falls back to `findFormByName()`, which searches every page on the site for a form ...
September 5, 2026 26
