---
id: "CVE-2026-114658"
kind: "vulnerability"
aliases: ["CVE-2026-114658"]
title: "Grav Login plugin: invite task lets page authors create super users"
severity: "high"
cvss: 8.8
epss: 0.00264
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["grav", "package", "php", "self-hosted"]
not_affected_if: ["plugin-already-3.9.13-or-later", "plugin-older-than-3.6.0"]
published_at: "2026-10-22T02:16:57+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-24T07:15:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114658", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114658", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Grav Login plugin: invite task lets page authors create super users

The Grav Login plugin before 3.9.13 has a missing authorization check in its login.invite task. An attacker who can author a page can grant super user access in the frontmatter and then register that address, which gives full control of the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the installed Login plugin version in the Grav admin plugins list or in user/plugins/login/blueprints.yaml; versions 3.6.0 through 3.9.12 are affected.

## Fix

Update the Grav Login plugin to 3.9.13 or later.
Review user accounts for unexpected super user entries and rotate credentials if any were added.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114658
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114658

## From the sources

Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the invited address for full site control.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_