What’s Vulnerable › Vulnerabilities

CVE-2026-114658: Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-22 · updated 2026-10-28
• Weakness: CWE-269

Description

Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the invited address for full site control.

Affected products

• getgrav grav-plugin-login: from 3.6.0 before 3.9.13 — fixed in 3.9.13

How to fix

Upgrade to a fixed version: getgrav grav-plugin-login 3.9.13. Check the vendor advisory for mitigations.

References

• https://github.com/getgrav/grav/security/advisories/GHSA-j8jx-ccrg-m7h2
• https://www.vulncheck.com/advisories/grav-login-plugin-3.6.0-before-3.9.13-privilege-escalation-via-login-invite

Get alerted when CVE-2026-114658 or the next vulnerability affects your stack