PT-2026-37279 · Grav · Grav+1

Baikuya · Published 2026-05-05 · Updated 2026-05-11 · CVE-2026-42613

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Grav version 1.8.0-beta.29 Login Plugin versions prior to 3.8.2

Description A missing server-side validation issue exists in the Login::register() function of the Login plugin. When user registration is enabled and the groups or access fields are included in the allowed fields configuration, an unauthenticated user can inject these variables into the registration request. Because the Login::validateField() function does not validate the groups and access parameters, an attacker can self-register with admin.super privileges. This privilege escalation can lead to full administrative panel access and potentially remote code execution (RCE).

Recommendations Update Login Plugin to version 3.8.2 or later. As a temporary workaround, remove groups and access from the user registration.fields list in the configuration to prevent unauthenticated users from injecting privilege levels.

Exploit

Fix

RCE

Missing Authorization

Weakness Enumeration

CWE-862

CWE-20

Related Identifiers

CVE-2026-42613

GHSA-PXM6-MHXR-Q4MJ

Affected Products

Grav

Login Plugin

References · 9

• 🔥 https://github.com/getgrav/grav/security/advisories/GHSA-w48r-jppp-rcfw · Exploit
• https://osv.dev/vulnerability/GHSA-pxm6-mhxr-q4mj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42613 · Security Note
• https://github.com/getgrav/grav · Note
• https://github.com/getgrav/grav/security/advisories/GHSA-pxm6-mhxr-q4mj · Note
• https://github.com/getgrav/grav-plugin-login/commit/3d419a0dabd70aed1fd49afcd5919004a4141da1 · Note
• https://twitter.com/Baikuya3/status/2052774563860111496 · Twitter Post
• https://twitter.com/CVEnew/status/2053932464318677114 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2053486214993649828 · Twitter Post