CVE-2026-114658: grav-plugin-login 3.6.0 to before 3.9.13

Affected technology

grav-plugin-login · 3.6.0 to before 3.9.13
getgrav

Description’s affected range: before 3.9.13

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the invited address for full site control. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality, integrity and availability impact as high.