Grav Login Plugin: Missing Authorization in login.invite (CVE-2026-114658)

The Grav Login plugin (versions 3.6.0 through 3.9.12) is vulnerable to a missing authorization issue within the login.invite task. An unauthenticated attacker can exploit this by crafting or locating a page with specific frontmatter that enables an invitation form granting super user privileges. By submitting this form, the attacker can register an arbitrary email address and gain full administrative access to the Grav instance.

Impact

Successful exploitation allows an unauthenticated attacker to obtain super user accounts, resulting in full site control and administrative compromise of the affected Grav instance.

Recommendation

• Upgrade the Grav Login plugin to version 3.9.13 or later immediately to address the missing authorization flaw.
• Review existing site pages and frontmatter configurations for unauthorized or unexpected invitation form definitions.
• Audit existing user accounts for suspicious registrations or unauthorized administrative escalations.