Is CVE-2026-114658 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114658 being exploited in the wild.

How severe is CVE-2026-114658?

High severity, with a CVSS score of 8.8, published 22 October 2026.

Which products and versions are affected?

Grav Login Plugin 3.6.0 to 3.9.12.

Am I affected by CVE-2026-114658?

Check whether you run Grav Login Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114658: Grav Login plugin missing authorization in invitation task

CVE-2026-114658 · Severity: high · CVSS 8.8 · Published 2026-10-22

The Grav Login plugin handles user account invitations and registration on Grav-based websites. A page author can craft an invitation form that grants super-user access, submit it without authentication, and create a super-user account, gaining full control of the site. This vulnerability bypasses access controls that should limit who can create privileged accounts.

Technologies: Grav Login Plugin. Vendors: Grav.

Quick answers

Is CVE-2026-114658 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114658 being exploited in the wild.
How severe is CVE-2026-114658?: High severity, with a CVSS score of 8.8, published 22 October 2026.
Which products and versions are affected?: Grav Login Plugin 3.6.0 to 3.9.12.
Is there a fix for CVE-2026-114658?: Yes: fixed in 3.9.13. Until then: Restrict the invitation page with the access: admin.login control in the page metadata; however, note that after patching, the sender will require account management permissions (admin.users or api.users.write) rather than just login access.</anigation> <parameter name="attack_vector">["network"] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114658 attacked?: It is in a software library.
Am I affected by CVE-2026-114658?: Check whether you run Grav Login Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.9.13

Restrict the invitation page with the access: admin.login control in the page metadata; however, note that after patching, the sender will require account management permissions (admin.users or api.users.write) rather than just login access.</anigation> <parameter name="attack_vector">["network"]

Technical details

The login.invite task in the Login plugin fails to verify that the form submitter has authorization to create user accounts or grant privileges. The task reads the account access level directly from page frontmatter with no restrictions, allowing any unauthenticated visitor to submit the form and specify super-user privileges. An attacker with page-authoring permissions can define an invitation form in frontmatter that grants super access, and registration via a valid invitation token copies those privileges into the new account.

Affected products

Grav Login plugin 3.6.0 to 3.9.12

Timeline

2026-10-07: disclosed
2026-10-22: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.