Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only vote_access…

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Oct 12, 2026 · NIST NVD

   Detected

   Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only vote_access and readonly enforcement. Attackers can use the anonymous nonce emitted by getData() to submit votes directly to addVote(), manipulating restricted or disabled ratings and aggregate rating output.

2. Oct 15, 2026 · NIST NVD

   Updated

   Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only vote_access and readonly enforcement. Attackers can use the anonymous nonce emitted by getData() to submit votes directly to addVote(), manipulating restricted or disabled ratings and aggregate rating output.

Sources

• CVE.orgVulnerability recordCVE-2026-109323

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-109323

  Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only vote_access and readonly enforcement. Attackers can use the anonymous nonce emitted by getData() to submit votes directly to

  nvd.nist.gov

References

• Reference · github.com
• Reference · vulncheck.com