Grav Login Plugin EUVD-2026-107900

Requires the Grav Login plugin (version 3.6.0 up to but not including 3.9.13) to be installed, plus an attacker holding page-author privileges capable of editing page frontmatter - this author foothold is the key limiting factor (PR:L), so the flaw is not exploitable by a fully anonymous outsider lacking authoring access. The specific trigger is defining an invitation form in page frontmatter that grants super access via the login.invite task, which can then be submitted without authentication to register the invited address. The missing authorization check on login.invite is the core defect; sites without any page authors beyond trusted administrators have a reduced attack surface.

This is a credible, actionable priority rather than an inflated high-CVSS number, but it is not a drop-everything remote-root issue. The CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, 8.7) and CWE-269 (Improper Privilege Management) align well with the description: a network-reachable, low-complexity privilege escalation requiring some existing low-level privilege (PR:L, consistent with the 'page authors' prerequisite). The full VC:H/VI:H/VA:H impact matches the stated outcome of obtaining a super user account and full site control. No EPSS score was supplied, the vulnerability is NOT in CISA KEV, and no public POC is referenced, so exploitation status is: no public exploit identified at time of analysis - meaning the risk today is latent potential rather than demonstrated mass exploitation. One nuance to verify: the description says page authors define the malicious invitation form (an authenticated/trusted-author action, supporting PR:L) but that the form is then 'submitted unauthenticated' to register the super account; the PR:L therefore reflects the author-level foothold needed to plant the form, not the final submission step. The real-world ceiling on risk is the need for a page-author-level account on a Grav site running the vulnerable Login plugin.

A user with page-author rights on a Grav site (e.g., a contributor on a multi-author blog or an attacker who has compromised a low-privilege authoring account) creates a page whose frontmatter defines a login.invite form that grants super-user access. The crafted invitation can then be submitted without authentication to register an attacker-controlled email address as a super user, yielding complete administrative control. No public exploit code is referenced, so this is based on the advisory description rather than a published POC.