high8.8
CVE-2026-114658
Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super use…
Impact
Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the invited address for full site control.
Affected products
| Product | Affected versions |
|---|---|
| Grav Login Plugin From 3.6.0 | before 3.9.13 |
Versions were read from the advisory text. No structured product data has been published for this record yet.