---
id: CVE-2026-114658
title: Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite
summary: >-
  Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization
  vulnerability in the login.invite task that allows page authors to obtain
  super user accounts. Attackers can define an invitation form granting super
  access in p…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-269
vendor: getgrav
product: grav-plugin-login
affected:
  - grav-plugin-login >= 3.6.0 < 3.9.13
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T01:43:43.437Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114658'
references:
  - url: 'https://github.com/getgrav/grav/security/advisories/GHSA-j8jx-ccrg-m7h2'
    label: GitHub Security Advisory (GHSA-j8jx-ccrg-m7h2)
  - url: >-
      https://www.vulncheck.com/advisories/grav-login-plugin-3.6.0-before-3.9.13-privilege-escalation-via-login-invite
    label: >-
      VulnCheck Advisory: Grav Login plugin 3.6.0 before 3.9.13 Privilege
      Escalation via login.invite
tags:
  - cve.org
ingestedAt: '2026-10-22T02:23:25.182Z'
---

## Overview

Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the invited address for full site control.

## Affected

- `grav-plugin-login >= 3.6.0 < 3.9.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.