CVE-2026-56709
Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled domains, bypassing the require_trusted_host protection which only covers password reset flows.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.26%
- CWE
- CWE-350
- Published
- 2026-08-25
- Last modified
- 2026-08-26
Affected products
- getgrav grav
- getgrav grav
Weakness type
Related vulnerabilities
- CVE-2026-55526 — PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)
- CVE-2026-75514 — BunkerWeb: rDNS bypass via missing forward-confirmation (FCrDNS) in blacklist, greylist, and antibot
- CVE-2026-63118 — MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection
- CVE-2026-55391 — datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding
- CVE-2026-46611 — Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack
- CVE-2026-12635 — Reliance on Reverse DNS Resolution for a Security-Critical Action in GitLab
- CVE-2026-42559 — RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport
- CVE-2026-6874 — ericc-ch copilot-api Header token dns rebinding