Missing Authorization Vulnerability in Grav Login Plugin by Grav
CVE-2026-114658

8.7HIGH

Key Information:

Vendor

Getgrav

Status
Grav-plugin-login
Vendor
CVE Published:
22 October 2026

What is CVE-2026-114658?

The Grav Login plugin prior to version 3.9.13 contains a security flaw in the login.invite task that exposes a significant risk of privilege escalation. This vulnerability allows page authors to create invitation forms in page frontmatter that facilitate unauthorized super user access. Attackers can exploit this issue to gain full control of the site by submitting the invitation forms without authentication.

Affected Version(s)

grav-plugin-login 3.6.0 < 3.9.13

grav-plugin-login 3.9.13

References

https://github.com/getgrav/grav/security/advisories/GHSA-...
vendor-advisory
https://www.vulncheck.com/advisories/grav-login-plugin-3....
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ffasterss
shirabe0x05
.