CVE-2026-114658 getgrav CVE debrief

Who should care

Grav site administrators and security teams should assess exposure and prioritize remediation due to the high CVSS score of 8.7 and the potential for privilege escalation. They should verify plugin versions and configurations, monitor for unauthorized account creations and privilege escalations, and implement compensating controls for exposed systems.

Why it matters

CVE-2026-114658 is a high-severity vulnerability in the Grav Login plugin that allows attackers to escalate privileges and gain full site control. Site administrators and security teams should prioritize remediation and verify plugin versions and configurations.

• Potential unauthorized account creations
• Privilege escalation to super user accounts
• Possible full site control by attackers
• Verification of Grav Login plugin version and configuration

Technical summary

The Grav Login plugin versions 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task. This allows page authors to obtain super user accounts by defining an invitation form granting super access in page frontmatter, submitting it unauthenticated, and registering the invited address for full site control. The vulnerability has a high CVSS score of 8.7, indicating a high severity. Site administrators and security teams should prioritize remediation and verify plugin versions and configurations.

Defensive priority

High priority for Grav site administrators and security teams

Recommended defensive actions

• Upgrade Grav Login plugin to version 3.9.13 or later
• Review and restrict access to the login.invite task
• Monitor for unauthorized account creations and privilege escalations
• Perform vulnerability scanning and penetration testing to identify potential exposures
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review Grav Login plugin configurations and ensure secure deployment

Evidence notes

The CVE record and source item provide details on the vulnerability in Grav Login plugin versions 3.6.0 before 3.9.13. Vendor advisory and third-party advisory sources are available. The vulnerability has a high CVSS score of 8.7, indicating a high severity. Defenders should verify plugin versions, configurations, and monitor for unauthorized account creations and privilege escalations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.