CVE-2026-114658— Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite
Quick assessment
Affected
getgrav grav-plugin-login
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Grav 的 Login 插件在 3.6.0 至 3.9.13（不含）版本中存在一个授权缺失漏洞，该漏洞位于 任务中，允许页面作者获取超级用户账户。攻击者可在页面的 frontmatter 中定义一个授予超级访问权限的邀请表单，在未进行身份验证的情况下提交该表单，从而将指定邮箱注册为拥有全站控制权的超级用户。
Possible ATT&CK Techniques 2 AI
T1548 · Abuse Elevation Control Mechanism T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114658
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite
Source: CVE Program / CVE List V5
Vulnerability Description
Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the invited address for full site control.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| getgrav | grav-plugin-login | 3.6.0 ~ 3.9.13 | - |
|
II. Public POCs for CVE-2026-114658
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114658
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-114658 (2)
Same Patch Batch · getgrav · 2026-10-22 · 4 CVEs total
| CVE-2026-114659 | 6.5 MEDIUM | Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes |
| CVE-2026-114660 | 6.3 MEDIUM | Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives |
| CVE-2026-114657 | 5.7 MEDIUM | Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri |
IV. Related Vulnerabilities
Same product: grav-plugin-login
-
CVE-2026-109314
Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Di -
CVE-2026-109313
Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember -
CVE-2026-109312
Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile -
CVE-2026-72699
Grav Login Plugin before 3.9.1 Email Enumeration via Registr -
CVE-2026-62671
CSRF in grav-plugin-login: anonymous attacker rotates a logg
Same vendor: getgrav
-
CVE-2026-114660
Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex -
CVE-2026-114659
Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass v -
CVE-2026-114657
Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via -
CVE-2026-112782
Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Deni -
CVE-2026-112781
Grav 2.0.0 before 2.2.2 Information Disclosure via Form conf
Same weakness: CWE-269
-
CVE-2026-110744
Multicluster-global-hub-operator-bundle: operator serviceacc -
CVE-2026-20291
Multiple Cisco Products Snort 3 Software Hardening Release: -
CVE-2026-114069
Trigger.dev before 4.6.0 Root Secret Disclosure via envvars -
CVE-2026-105312
Console-operator: streams for apache kafka console: tenant-c -
CVE-2026-105453
IBM Sterling Connect:Direct for Unix Improper Privilege Mana
V. Comments for CVE-2026-114658
No comments yet