Grav Login plugin: Privilege escalation via login.invite invitation form
Summary
The Login plugin for the Grav CMS (3.6.0 to 3.9.12) lets anyone who can load a page with an invitation form submit it without signing in. The form's frontmatter can grant super user access, so an attacker can register an invited address as a super user. An attacker who can create or edit pages, for example with a compromised editor account, can take full control of the site without administrator involvement.
Affected
- getgrav/grav-plugin-login (Login plugin) versions 3.6.0 through 3.9.12
- Runs on Grav 1.7 and Grav 2.x
- Sites without an invitation form on a page are likely not affected via this path (assessment)
Fixed in
- Login plugin 3.9.13
Workaround
Unknown. The vendor documents no workaround; the only documented remedy is upgrading to 3.9.13.
- If an upgrade must be delayed (own suggestions, not vendor guidance): limit who can create or edit pages, review pages for invitation form definitions, review user accounts for unexpected super users, and review pending invitations in user/data/accounts/invites.yaml
Exploitation
- Not marked as known exploited (KEV: No).
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept found; sources conflict on exploit availability, so treat it as unconfirmed.
Our recommendation
- Inventory all Grav sites and check composer.lock for getgrav/grav-plugin-login versions 3.6.0 to 3.9.12.
- Upgrade affected sites to 3.9.13, testing first.
- Audit super user accounts and recent invitations.
- Review who holds page-authoring rights.
- Check logs for unexpected account creation.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-j8jx-ccrg-m7h2 github.com
- VulnCheck advisory: Grav Login plugin privilege escalation via login.invite www.vulncheck.com
- VulDB entry 425123 vuldb.com
- Login plugin changelog github.com
- HOL Guard CVE-2026-114658 hol.org
- Strix CVE-2026-114658 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:56.
Original description (NVD)
Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the invited address for full site control.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.