{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/login-plugin-3.6.0---3.9.12/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:getgrav:login:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-114658"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Login plugin (3.6.0 - 3.9.12)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Grav"],"content_html":"\u003cp\u003eThe Grav Login plugin (versions 3.6.0 through 3.9.12) is vulnerable to a missing authorization issue within the \u003ccode\u003elogin.invite\u003c/code\u003e task. An unauthenticated attacker can exploit this by crafting or locating a page with specific frontmatter that enables an invitation form granting super user privileges. By submitting this form, the attacker can register an arbitrary email address and gain full administrative access to the Grav instance.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to obtain super user accounts, resulting in full site control and administrative compromise of the affected Grav instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Grav Login plugin to version 3.9.13 or later immediately to address the missing authorization flaw.\u003c/li\u003e\n\u003cli\u003eReview existing site pages and frontmatter configurations for unauthorized or unexpected invitation form definitions.\u003c/li\u003e\n\u003cli\u003eAudit existing user accounts for suspicious registrations or unauthorized administrative escalations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T03:52:47Z","date_published":"2026-10-22T03:52:47Z","id":"https://feed.craftedsignal.io/briefs/2026-10-grav-login-auth-bypass/","summary":"The Grav Login plugin contains a missing authorization flaw in the login.invite task, allowing unauthenticated attackers to register arbitrary email addresses as super users by manipulating page frontmatter.","title":"Grav Login Plugin: Missing Authorization in login.invite (CVE-2026-114658)","url":"https://feed.craftedsignal.io/briefs/2026-10-grav-login-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Login Plugin (3.6.0 - 3.9.12)","version":"https://jsonfeed.org/version/1.1"}