CPE
The Grav Login plugin contains a missing authorization flaw in the login.invite task, allowing unauthenticated attackers to register arbitrary email addresses as super users by manipulating page frontmatter.