PT-2026-120940

CVE-2026-114658

Published

2026-10-22

Updated

2026-10-22

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Grav Login plugin versions 3.6.0 through 3.9.12

Description An authorization flaw exists in the login.invite task. This issue allows page authors to obtain super user accounts by defining an invitation form that grants super access within the page frontmatter. An unauthenticated attacker can then submit this form and register the invited address to gain full control of the site.

Recommendations Update Grav Login plugin to version 3.9.13 or later.

Exploitability

Fix

Impacts

Researchers

Ffasterss

Shirabe0X05

Vendors

Affected products

Weakness enumeration

CWE-269: Improper Privilege Management

Related identifiers