Key points
- The vulnerability affects the Grav Login plugin versions 3.6.0 through 3.9.12.
- Attackers can submit unauthenticated invitation forms to grant themselves full site control.
- The flaw is rated 8.7 on the CVSS scale and involves missing authorization checks.
The Grav Login plugin contains a high-severity authorization flaw that affects all versions from 3.6.0 up to, but not including, 3.9.13. According to the National Vulnerability Database record for CVE-2026-114658, this issue allows page authors to bypass standard permissions. The flaw enables these users to create super user accounts, effectively granting them complete administrative control over the website without requiring prior authentication or higher-level privileges.
In plain English
This issue stems from a missing authorization check within the login.invite task of the plugin. An attacker who has page author permissions can define an invitation form directly in the page frontmatter. By submitting this form, they can register an email address for full site access. This process does not require the attacker to be logged in at the time of submission. Once the invited address is registered, the attacker gains super user status and can manage the entire site.
The background
The vulnerability is classified under CWE-269, which refers to improper privilege management. The National Vulnerability Database assigns it a base score of 8.7, placing it in the high severity range. This specific flaw impacts the Grav content management system, which relies on the Login plugin for user authentication. The issue was identified in versions starting with 3.6.0 and remains present in all subsequent releases prior to the patched version.
What changes now
Site administrators must update the Grav Login plugin to version 3.9.13 or later to resolve this issue. This update restores proper authorization checks to the invitation process. Without this fix, any user with page author capabilities can escalate their privileges to super user status. Organizations running earlier versions should prioritize this update immediately to prevent unauthorized administrative access. No alternative mitigation is confirmed by the vendor aside from applying the patched version.
Who needs to act first
Teams usually prioritize systems exposed to the internet or those accessible by external contributors. Check whether your site allows page authors to modify frontmatter or use invitation features. Verify current plugin versions across all environments before applying changes. Roll out updates to staging servers first to ensure compatibility with existing themes and other plugins. Back up site data before making configuration changes. Monitor logs for unusual invitation submissions or new super user accounts appearing without administrative approval.
What to do and how to stay safe: Grav
- Update the Grav Login plugin to version 3.9.13 or later as soon as possible.
- Audit existing user accounts to identify any super users created recently without administrative approval.
- Review page frontmatter for any unauthorized invitation forms that may have been added by compromised accounts.
- Restrict page author permissions to only those individuals who absolutely require them for content creation.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of the Grav Login plugin are affected?
Versions 3.6.0 through 3.9.12 are affected by this vulnerability.
Is there a confirmed fix for CVE-2026-114658?
Yes, updating to version 3.9.13 or later resolves the issue.
What can an attacker do with this flaw?
An attacker can create super user accounts and gain full control of the site.
