Executive brief
A vulnerability in the Grav CMS Login plugin allows unauthenticated users to grant themselves administrative privileges during account registration. Grav is a popular content management system, and this flaw could allow an attacker to take full control of a website, access sensitive data, or modify site content. This occurs if the site administrator has enabled user registration and allowed certain permission-related fields to be visible in the registration form.
Technical details
The `Login::register()` method in the Grav Login plugin fails to validate or sanitize the `groups` and `access` fields provided in registration POST requests. If an administrator has configured these fields as 'allowed' in the registration form settings, the plugin checks if they are present in the input; if they are, it bypasses default configuration values and assigns the attacker-supplied values directly to the new user object. An unauthenticated attacker can exploit this by injecting `admin.super` permissions into the registration request, gaining full administrative access. This can be further leveraged to achieve Remote Code Execution (RCE) through existing administrative features or plugin uploads. The issue is fixed in Login plugin version 3.8.2.
Affected products
- getgrav Grav Login Plugin < 3.8.2
- getgrav Grav Core < 2.0.0-beta.2
Timeline
- 2026-04-24: patched: Fix applied in grav-plugin-login 3.8.2
- 2026-04-27: disclosed: Advisory published by maintainers
- 2026-05-05: advisory: GitHub Advisory published
- 2026-05-11: other: NVD publication date