critical · CVSS v3 8.8 · CVSS v4 8.7

CVE-2026-114658

Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that …

Description

Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the invited address for full site control.

Scores

Severity
critical
CVSS v2
9
CVSS v3
8.8
CVSS v4
8.7
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-84920

Drupal Unpublished Node Permissions allows attackers to forcefully browse unpublished content due to incorrect authorization checks. The flaw exists in versions 0.0.0 through 1.8.0 and can expose sensitive draft pages to unauthenticated users. It is a critical vulnerability with a CVSS score of 9.1.

View analysis

critical

CVE-2026-87936

The CVE-2026-87936 vulnerability is a critical SQL injection flaw in the amazee.ai Private AI Provider, a Drupal-based service. It allows attackers to inject malicious SQL commands, potentially exposing or corrupting sensitive data. The flaw affects all versions up to 1.4.3.

View analysis

critical

CVE-2026-84921

Drupal Webform Submissions Delete plugin has a missing authorization flaw that lets attackers delete any submission. The vulnerability is present in all releases up to 1.2.0. It can be exploited by unauthenticated users to remove data and potentially disrupt site operations.

View analysis

critical

CVE-2026-84916

Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0.

View analysis