Is CVE-2026-62232 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62232 being exploited in the wild.

How severe is CVE-2026-62232?

High severity, with a CVSS score of 7.4, published 17 July 2026.

Which products and versions are affected?

Grav before 2.0.4; getgrav/grav (Packagist) ECOSYSTEM:introduced=0,fixed=2.0.4.

Is there a fix for CVE-2026-62232?

Yes. getgrav/grav (Packagist): upgrade to 2.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-62232 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-62232?

Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62232: Grav Login plugin two-factor authentication bypass in regenerate2FASecret

CVE-2026-62232 · Severity: high · CVSS 7.4 · Published 2026-07-17

Grav, a popular open-source content management system, contains a security flaw in its login system that allows attackers to bypass two-factor authentication (2FA). If an attacker already knows a user's password, they can exploit this vulnerability to reset the 2FA security key to one they control, effectively locking the legitimate user out and gaining full access to the account. This bypasses the extra layer of security intended to protect sensitive administrative areas and user data.

Technologies: Grav, getgrav/grav (Packagist). Vendors: Grav, Packagist.

Quick answers

Is CVE-2026-62232 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62232 being exploited in the wild.
How severe is CVE-2026-62232?: High severity, with a CVSS score of 7.4, published 17 July 2026.
Which products and versions are affected?: Grav before 2.0.4; getgrav/grav (Packagist) ECOSYSTEM:introduced=0,fixed=2.0.4.
Is there a fix for CVE-2026-62232?: Yes. getgrav/grav (Packagist): upgrade to 2.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62232 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-62232?: Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

getgrav/grav (Packagist): upgrade to 2.0.4 or later
```
composer require getgrav/grav:^2.0.4
```

Technical details

A missing authorization check (CWE-862) in the Grav Login plugin allows for a 2FA bypass. When a user provides valid primary credentials, the system assigns the user object to the session before TOTP verification is complete. During this 'pending-challenge' window, the 'regenerate2FASecret' task can be invoked without a CSRF nonce because it only verifies that a user exists in the session, not that they are fully authorized. An attacker with the victim's password can trigger this task to overwrite the victim's TOTP secret on disk, receive the new secret in the JSON response, and generate a valid code to complete authentication. This vulnerability is patched in Grav version 2.0.4.

Affected products

getgrav Grav before 2.0.4

Identifiers

CVE-2026-62232
GHSA-7mgc-c7pq-3rr3

Timeline

2026-06-29: advisory: Original GitHub security advisory published
2026-07-16: patched: Vulnerability addressed in version 2.0.4
2026-07-17: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.