{"id":"CVE-2026-114658","kind":"vulnerability","aliases":["CVE-2026-114658"],"related":[],"title":"Grav Login plugin: invite task lets page authors create super users","description":"Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the invited address for full site control.","summary":"The Grav Login plugin before 3.9.13 has a missing authorization check in its login.invite task. An attacker who can author a page can grant super user access in the frontmatter and then register that address, which gives full control of the site.","severity":"high","cvss":8.8,"epss":0.00264,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["grav","package","php","self-hosted"],"not_affected_if":["plugin-already-3.9.13-or-later","plugin-older-than-3.6.0"],"how_to_check":"Check the installed Login plugin version in the Grav admin plugins list or in user/plugins/login/blueprints.yaml; versions 3.6.0 through 3.9.12 are affected.","fix":"Update the Grav Login plugin to 3.9.13 or later.\nReview user accounts for unexpected super user entries and rotate credentials if any were added.","status":"open","published_at":"2026-10-22T02:16:57+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-23T22:32:38+00:00","updated_at":"2026-10-24T07:15:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:32:38Z","model":"claude-haiku-5-5","output":{"fix":"Update the Grav Login plugin to 3.9.13 or later.\nReview user accounts for unexpected super user entries and rotate credentials if any were added.","reach":"internet","title":"Grav Login plugin: invite task lets page authors create super users","impact":"high","summary":"The Grav Login plugin before 3.9.13 has a missing authorization check in its login.invite task. An attacker who can author a page can grant super user access in the frontmatter and then register that address, which gives full control of the site.","category":"package","who_cares":["grav","php","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker gains super user account and full control of the site","analyst_note":"","how_to_check":"Check the installed Login plugin version in the Grav admin plugins list or in user/plugins/login/blueprints.yaml; versions 3.6.0 through 3.9.12 are affected.","needs_analyst":false,"not_affected_if":["plugin-older-than-3.6.0","plugin-already-3.9.13-or-later"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000492,"input_tokens":2933,"output_tokens":398,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114658':14A,17A '-2026':13A,16A '3.6.0':70C '3.9.13':29B,72C 'access':50B,99C 'account':90C 'address':58B,110C 'allow':83C 'attack':40B,91C 'author':8A,33B,43B,76C,85C 'check':34B 'contain':73C 'control':62B,114C 'creat':9A 'cve':12A,15A 'defin':93C 'form':96C 'frontmatt':53B,102C 'full':61B,112C 'give':60B 'grant':47B,97C 'grav':1A,18B,25B,66C 'host':23B 'invit':4A,95C,109C 'let':6A 'login':2A,26B,67C 'login.invite':37B,80C 'miss':32B,75C 'obtain':87C 'packag':19B 'page':7A,45B,84C,101C 'php':20B 'plugin':3A,27B,68C 'regist':56B,107C 'self':22B 'self-host':21B 'site':65B,113C 'submit':103C 'super':10A,48B,88C,98C 'task':5A,38B,81C 'unauthent':105C 'user':11A,49B,89C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114658","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114658","severity":null,"published_at":"2026-10-22T02:16:57+00:00","modified_at":"2026-10-22T17:40:46+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114658","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114658","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}