CVE-2026-42613: Grav Login plugin privilege escalation in registration handler

CVE-2026-42613 · Severity: critical · CVSS 9.4 · Published 2026-05-11

A vulnerability in the Grav CMS Login plugin allows unauthenticated users to grant themselves administrative privileges during account registration. Grav is a popular content management system, and this flaw could allow an attacker to take full control of a website, access sensitive data, or modify site content. This occurs if the site administrator has enabled user registration and allowed certain permission-related fields to be visible in the registration form.

Technologies: Grav, Grav Login Plugin, getgrav/grav (Packagist). Vendors: Grav, Packagist.

Quick answers

Is CVE-2026-42613 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42613 being exploited in the wild.
How severe is CVE-2026-42613?
Critical severity, with a CVSS score of 9.4, published 11 May 2026.
Which products and versions are affected?
Grav < 2.0.0-beta.2, < 3.8.2; Grav Login Plugin < 3.8.2; getgrav/grav (Packagist) < 2.0.0-beta.2, ECOSYSTEM:introduced=0,fixed=2.0.0-beta.2.
Is there a fix for CVE-2026-42613?
Yes. getgrav/grav (Packagist): upgrade to 2.0.0-beta.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42613 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-42613?
Check whether you run Grav, Grav Login Plugin or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • getgrav/grav (Packagist): upgrade to 2.0.0-beta.2 or later
    composer require getgrav/grav:^2.0.0-beta.2

Technical details

The `Login::register()` method in the Grav Login plugin fails to validate or sanitize the `groups` and `access` fields provided in registration POST requests. If an administrator has configured these fields as 'allowed' in the registration form settings, the plugin checks if they are present in the input; if they are, it bypasses default configuration values and assigns the attacker-supplied values directly to the new user object. An unauthenticated attacker can exploit this by injecting `admin.super` permissions into the registration request, gaining full administrative access. This can be further leveraged to achieve Remote Code Execution (RCE) through existing administrative features or plugin uploads. The issue is fixed in Login plugin version 3.8.2.

Affected products

  • getgrav Grav Login Plugin < 3.8.2
  • getgrav Grav Core < 2.0.0-beta.2

Identifiers

  • CVE-2026-42613
  • GHSA-pxm6-mhxr-q4mj

Timeline

  • 2026-04-24: patched: Fix applied in grav-plugin-login 3.8.2
  • 2026-04-27: disclosed: Advisory published by maintainers
  • 2026-05-05: advisory: GitHub Advisory published
  • 2026-05-11: other: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.