Is CVE-2026-109323 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109323?

CVE-2026-109323 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-109323

Description

Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only vote_access and readonly enforcement. Attackers can use the anonymous nonce emitted by getData() to submit votes directly to addVote(), manipulating restricted or disabled ratings and aggregate rating output.