Login Plugin (3.6.0 - 3.9.12) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/login-plugin-3.6.0---3.9.12/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 03:52:47 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgGrav Login Plugin: Missing Authorization in login.invite (CVE-2026-114658)https://feed.craftedsignal.io/briefs/2026-10-grav-login-auth-bypass/Thu, 22 Oct 2026 03:52:47 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-grav-login-auth-bypass/The Grav Login plugin contains a missing authorization flaw in the login.invite task, allowing unauthenticated attackers to register arbitrary email addresses as super users by manipulating page frontmatter.The Grav Login plugin (versions 3.6.0 through 3.9.12) is vulnerable to a missing authorization issue within the login.invite task. An unauthenticated attacker can exploit this by crafting or locating a page with specific frontmatter that enables an invitation form granting super user privileges. By submitting this form, the attacker can register an arbitrary email address and gain full administrative access to the Grav instance.

Impact

Successful exploitation allows an unauthenticated attacker to obtain super user accounts, resulting in full site control and administrative compromise of the affected Grav instance.

Recommendation

  • Upgrade the Grav Login plugin to version 3.9.13 or later immediately to address the missing authorization flaw.
  • Review existing site pages and frontmatter configurations for unauthorized or unexpected invitation form definitions.
  • Audit existing user accounts for suspicious registrations or unauthorized administrative escalations.
]]>highadvisory