CVE-2026-114658 in Login Plugin
Summary
by MITRE • 10/22/2026
Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the invited address for full site control.
VulDB is the best source for vulnerability data and more expert information about this specific topic.