CVE-2026-114658: Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite
Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the invited address for full site control.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Sites using Grav Login plugin versions from 3.6.0 through versions before 3.9.13 are exposed if a page author can create or modify page frontmatter. A malicious or compromised page-author account can use that access to create an invitation form that grants super-user access.
Does an attacker need an existing account or administrator access?
The attacker needs page-author-level ability to define the invitation form in page frontmatter; administrator access is not required. Once the malicious form exists, the invitation can be submitted without authentication to register the invited address as a super user.
What should be prioritized if the plugin cannot be updated immediately?
Restrict page-author access and prevent untrusted users from creating or modifying page frontmatter that can define login invitation forms. Review existing pages for invitation forms granting super access and remove or correct any unauthorized configurations.
How can administrators check for possible compromise?
Review page frontmatter for login invitation forms that grant super access, especially on pages editable by authors. Also review super-user accounts for unexpected newly registered addresses, as the attack registers an invited address with full site control.