---
id: CVE-2026-114658
title: Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite
summary: >-
  Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization
  vulnerability in the login.invite task that allows page authors to obtain
  super user accounts. Attackers can define an invitation form granting super
  access in p…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-269
vendor: getgrav
product: grav-plugin-login
affected:
  - grav-plugin-login >= 3.6.0 < 3.9.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-28T18:59:20.904897Z'
published: '2026-10-22'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T18:59:54.096Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114658'
references:
  - url: 'https://github.com/getgrav/grav/security/advisories/GHSA-j8jx-ccrg-m7h2'
    label: GitHub Security Advisory (GHSA-j8jx-ccrg-m7h2)
  - url: >-
      https://www.vulncheck.com/advisories/grav-login-plugin-3.6.0-before-3.9.13-privilege-escalation-via-login-invite
    label: >-
      VulnCheck Advisory: Grav Login plugin 3.6.0 before 3.9.13 Privilege
      Escalation via login.invite
tags:
  - cve.org
epss: 0.00264
epssPercentile: 0.18294
ingestedAt: '2026-10-22T02:23:25.182Z'
---

## Overview

Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the invited address for full site control.

## Affected

- `grav-plugin-login >= 3.6.0 < 3.9.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.