HIGHCVSS v3.1 8.8Vulnerability
CVE-2026-114658
Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the invited address for full site control.
Properties
- Severity
- HIGH
- Nvd fetched at
- 2026-10-22T22:14:18.200859+00:00
- Epss score
- 0.00264
- Cvss severity
- HIGH
- Cvss score
- 8.8
- Retrieved at
- 2026-10-22T22:17:33+00:00
- Last source
- FIRST EPSS
- Score
- 8.8
- Cvss version
- 3.1
- Cve id
- CVE-2026-114658
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- First seen by Signal
- 2026-10-22T06:03:26+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Published at
- 2026-10-22T02:16:57.770
- Last modified
- 2026-10-22T17:40:46.877
- Epss percentile
- 0.17304
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph