High severity · published Oct 22, 2026
CVE-2026-114658
Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite
New
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the invited address for full site control.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
grav-plugin-login · getgrav
3.6.0 before 3.9.13 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114658
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114658
github.com
https://github.com/getgrav/grav/security/advisories/GHSA-j8jx-ccrg-m7h2
www.vulncheck.com
https://www.vulncheck.com/advisories/grav-login-plugin-3.6.0-before-3.9.13-privilege-escalation-via-login-invite
More from grav-plugin-login
8.1
CVE-2026-109313
Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie
8.1
CVE-2026-109312
Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form
7.4
CVE-2026-62669
Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge
7.3
CVE-2026-109314
Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page
5.4
CVE-2026-62671
CSRF in grav-plugin-login: anonymous attacker rotates a logged-in user's 2FA (TOTP) secret (no nonce on task=login.regenerate2FASecret)