Live › vulnerability › CVE-2026-114658
Go to dashboardThe Grav Login plugin before 3.9.13 has a missing authorization check in its login.invite task. An attacker who can author a page can grant super user access in the frontmatter and then register that address, which gives full control of the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed Login plugin version in the Grav admin plugins list or in user/plugins/login/blueprints.yaml; versions 3.6.0 through 3.9.12 are affected.
3.9.13 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the invited address for full site control.
This page as .md · .json · in your agent: get_signal("CVE-2026-114658")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.