high7.5
CVE-2026-56709
Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing token-bearing invitation links.
Impact
Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled domains, bypassing the require_trusted_host protection which only covers password reset flows.
Affected products
| Product | Affected versions |
|---|---|
| Grav | before 3.9.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.