Getgrav: Critical Login Plugin Flaw and Two Core CMS Vulns Disclosed Together
Getgrav: Three vulnerabilities, including a critical privilege escalation in the Login plugin, disclosed together on October 22, 2026.
Key findings
- High-severity flaw in Grav Login plugin allows privilege escalation to super user.
- Core Grav CMS vulnerable to arbitrary method execution via crafted page frontmatter.
- Information disclosure vulnerability allows capture of visitor HTTP Basic credentials.
- All issues patched in Grav 2.2.5 and Login plugin 3.9.13.
- Batch includes one high and two medium severity CVEs disclosed together.
On October 22, 2026, a batch of three vulnerabilities was disclosed for Getgrav, a popular open-source content management system. These vulnerabilities, affecting the core Grav CMS and its Login plugin, were published together, indicating a coordinated disclosure event. The issues range in severity, with one high-severity flaw in the Login plugin allowing for privilege escalation, and two medium-severity flaws in the core CMS enabling arbitrary method execution and information disclosure. These findings highlight potential risks for Grav administrators and users, particularly concerning unauthorized access and sensitive data exposure.
The core Grav CMS is affected by two medium-severity vulnerabilities. CVE-2026-114660, with a CVSS score of 6.3, stems from improper access control within the FlexDirectory::dynamicFlexField() function. This flaw allows authenticated users with page editing privileges to execute arbitrary Flex object methods by embedding specially crafted flex-*@ directives in page frontmatter. When such a page is accessed, these directives can be triggered, potentially leading to unintended actions.
Additionally, CVE-2026-114657, rated at 5.7, is an information disclosure vulnerability in Grav versions 2.0.0 through 2.2.4. This issue permits page authors to capture visitors' HTTP Basic authentication credentials. By embedding specific Twig code within an inline style background image, authors can exfiltrate sensitive information like usernames and passwords that are transmitted via HTTP Basic authentication.
The most critical vulnerability disclosed is CVE-2026-114658, a high-severity flaw (CVSSv3 8.8) affecting the Grav Login plugin versions 3.6.0 through 3.9.12. This vulnerability lies in the login.invite task, which suffers from missing authorization checks. Attackers can exploit this by defining an invitation form with super user privileges within page frontmatter. When this form is submitted, even without authentication, the invited email address can be registered, granting the attacker super user access to the Grav instance.
All three vulnerabilities were fixed in Grav versions 2.2.5 and the Login plugin version 3.9.13. Users are strongly advised to update to these patched versions immediately to mitigate the risks associated with privilege escalation and sensitive data exposure. Maintaining updated software is crucial for safeguarding Grav installations against these types of security threats.
This coordinated disclosure of three vulnerabilities, including a critical privilege escalation flaw in the Login plugin, underscores the importance of timely patching for Grav CMS users. The ability for authenticated users to execute arbitrary code and the potential for unauthenticated users to gain super administrator access present significant security risks that demand immediate attention.
Key findings include:
- A high-severity vulnerability in the Grav Login plugin allows unauthenticated users to gain super user access.
- Improper access control in the core Grav CMS enables arbitrary method execution via page frontmatter.
- An information disclosure flaw allows page authors to capture visitor HTTP Basic credentials.
- All disclosed vulnerabilities are fixed in Grav 2.2.5 and Login plugin 3.9.13.
- The batch includes one high and two medium severity vulnerabilities disclosed on the same day.