What is GHSA-hgwc-2mf9-5m4j?

GHSA-hgwc-2mf9-5m4j is a security advisory published by GitHub Security Advisories with High severity. Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the...

Which CVE IDs does GHSA-hgwc-2mf9-5m4j cover?

GHSA-hgwc-2mf9-5m4j covers the following CVE IDs: CVE-2026-114658. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hgwc-2mf9-5m4j?

GHSA-hgwc-2mf9-5m4j has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-hgwc-2mf9-5m4jHighCVSS 8.8

Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the...

Vendor

GitHub Security Advisories

Published

October 22, 2026

Last Modified

October 22, 2026

🔗 CVE IDs covered (1)

CVE-2026-114658 →

📋 Description

Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the invited address for full site control.

🔗 References (4)

https://github.com/getgrav/grav/security/advisories/GHSA-j8jx-ccrg-m7h2
https://nvd.nist.gov/vuln/detail/CVE-2026-114658
https://www.vulncheck.com/advisories/grav-login-plugin-3.6.0-before-3.9.13-privilege-escalation-via-login-invite
https://github.com/advisories/GHSA-hgwc-2mf9-5m4j