The Grav Login plugin contains a flaw that allows an attacker to determine whether a given email address is registered on a site. The register() method throws an EMAIL_NOT_AVAILABLE exception only when the email already exists, while permitting registration otherwise. Because the endpoint does not apply rate limiting or generic error handling, the difference in responses directly exposes account existence. This results in information disclosure that can facilitate targeted phishing or credential stuffing attacks.

The vulnerability is present in getgrav/grav-plugin-login versions earlier than 3.9.1 running on the Grav CMS. Any site that has not upgraded the login plugin to 3.9.1 or later inherits this flaw. The affected product is Grav CMS with the login plugin.

With a CVSS score of 9.3 the flaw is considered high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the lack of rate limiting means an attacker can launch a brute‑force enumeration attack by sending repeated registration requests, one for each email guess. The attack vector is remote over the web, requiring only public access to the registration endpoint. Due to the clear distinction in the response messages, exploitation is straightforward and could be automated, making the risk significant for exposed user databases.