Which versions of Grav are affected by CVE-2026-62232?

Grav CMS deployments running versions below 2.0.4 contain a critical authentication bypass that neutralizes two-factor authentication protections for any user whose password has been compromised.. A patch is available.

How to fix or mitigate CVE-2026-62232?

Within 24 hours, inventory all Grav CMS instances to identify versions below 2.0.4 and assess which systems contain sensitive data or administrative functions. Within 7 days, disable TOTP-based 2FA on all vulnerable instances as an interim security measure, implement IP allowlisting for administrative access, enable detailed audit logging of login events and user account modifications, and configure alerting on suspicious authentication activity. Within 30 days, maintain watch for Grav CMS 2.0.4 release, conduct testing in a non-production environment, and prepare a controlled deployment plan including mandatory password resets for all users following the upgrade.

Grav CVE-2026-62232

Q: What is the CVSS score of CVE-2026-62232?

CVE-2026-62232 has a CVSS 4.0 base score of 9.1 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

EUVD-2026-45120 CRITICAL

Missing Authorization (CWE-862)

2026-07-17 VulnCheck

GHSA-4m9m-rmh9-2pgf

CSRF Authentication Bypass Grav

9.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.1 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 17, 2026 - 02:32 EUVD

Analysis Generated

Jul 17, 2026 - 00:54 vuln.today

CVE Published

Jul 17, 2026 - 00:07 cve.org

CRITICAL 9.1

DescriptionCVE.org

Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin where the regenerate2FASecret task checks only user existence, not authorization, during the pending TOTP challenge window. Attackers who know the victim's password can call this task without a CSRF nonce to overwrite the 2FA secret with an attacker-chosen value, compute a valid TOTP code, and complete authentication while reducing 2FA to password-only protection.

AnalysisAI

Two-factor authentication bypass in Grav CMS before 2.0.4 lets an attacker who already knows a victim's password overwrite that user's TOTP secret and log in with full 2FA protection stripped away. During the pending TOTP challenge window the login plugin's regenerate2FASecret task verifies only that the user exists — not that the caller is authorized — and requires no CSRF nonce, so the attacker sets an attacker-chosen secret, computes a valid code, and completes login. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, inventory all Grav CMS instances to identify versions below 2.0.4 and assess which systems contain sensitive data or administrative functions. …

Threat intelligence, references, and detailed analysis are available after sign-in.