CVE-2026-114658: Improper Privilege Management in getgrav grav-plugin-login
Description
The Grav Login plugin versions from 3.6.0 up to but not including 3.9.13 contains a missing authorization vulnerability in the login.invite task. This flaw allows unauthenticated attackers to create invitation forms in page frontmatter that grant super user access. By submitting such a form, attackers can register an invited address with full site control, effectively escalating privileges to super user.
CVSS v4.0
Score 8.7high
Affected software
getgrav
grav-plugin-login
pkg:github/getgrav/grav-plugin-loginRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-114658 is a privilege escalation vulnerability in the Grav Login plugin affecting versions >=3.6.0 and <3.9.13. The vulnerability arises from missing authorization checks in the login.invite task, enabling attackers to define invitation forms that grant super user privileges via page frontmatter. Attackers can submit these forms without authentication and register accounts with full administrative control over the site.
Potential Impact
Successful exploitation results in unauthorized creation of super user accounts, granting full control over the affected Grav site. This can lead to complete site compromise, including data manipulation, configuration changes, and potential further attacks on the hosting environment.
Mitigation Recommendations
A fix is available in versions 3.9.13 and later. Users should upgrade the grav-plugin-login to version 3.9.13 or newer to remediate this vulnerability. Until patched, restrict access to page frontmatter editing and monitor for unauthorized invitation forms.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-21T21:59:05.256Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad96eff4d27ba8daa1d22f9
Added to database: 10/22/2026, 02:03:43 UTC
Last enriched: 10/22/2026, 02:15:33 UTC
Last updated: 10/22/2026, 02:18:51 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.