HIGH 8.7 NVD
CVE-2026-114658
Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user
Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the invited address for full site control.
References
- https://github.com/getgrav/grav/security/advisories/GHSA-j8jx-ccrg-m7h2
- https://www.vulncheck.com/advisories/grav-login-plugin-3.6.0-before-3.9.13-privilege-escal
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-10-22 via NVD.
vulnfeed aggregates 18809 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.