CVE-2026-42613 Details

A vulnerability in the Grav Login plugin, affecting versions prior to 2.0.0-beta.2, allows for unauthorized privilege escalation. The issue arises because the Login::register() method accepts user-supplied groups and access fields from the registration POST data without proper server-side validation. When registration is enabled and these fields are included in the allowed fields list, an attacker can self-register with admin.super privileges by injecting the fields into the registration request. This vulnerability is rooted in the absence of adequate validation, leaving only a configuration-based allowlist as a defense, which is not a reliable security measure.

Users can update to Grav Login Plugin version 2.0.0-beta.2 or later, where this vulnerability has been fixed. Instructions for updating the plugin can be found in the Grav documentation.