psf-grav-login-check(8)

Script: /opt/psf-security-patches/grav/grav-login-check.sh. Tool page: Grav. Source. With the package installed: man psf-grav-login-check.

Grav CMS Login plugin invitation privilege escalation: read-only checker  (v1)
CVE-2026-114658 (GHSA-j8jx-ccrg-m7h2)

If this software is helpful, consider a donation to our 501c3 nonprofit:
https://privacysafe.foundation

The Login plugin's invitation task (login.invite) sends an invitation without
checking who submitted the form, and takes the new account's access straight from
the page's frontmatter (form: meta: invite: account:) with no cap on what is
granted. A page author can therefore define an invitation form that grants super
user access, submit it, and register the invited address for full control of the
site. VulnCheck describes the submission as possible without authentication.
CVSS 8.7 (v4.0), 8.8 (v3.1).

  Affected: Grav Login plugin 3.6.0 through 3.9.12 (Grav 1.7 and 2.x)
  Fixed:    3.9.13. Only a super user can then invite someone into super access
            or into groups; for anyone else those are removed from the invitation.
            A page restricted with "access: admin.login" now needs an account
            management permission to send invitations.

This script is read-only. "check" finds Grav sites (a user/plugins/login directory),
reads the Login plugin version from blueprints.yaml, and lists pages that declare an
invitation form. "hunt" also looks for what an attack leaves behind: pending
invitations and page frontmatter that grant super access, and super-user accounts
changed recently. It NEVER prints invitation tokens (the keys of invites.yaml),
password hashes or any account secret: it reports only account file names, email
addresses of invitations and modification times.

Usage:
  ./grav-login-check.sh [command] [DIR ...]

  check (default)  scan DIR (default /var/www /srv /opt /home). Exit 0 = nothing
                   affected, 1 = an affected Login plugin found.
  hunt             check, then search for signs of abuse. Exit 0 = nothing found,
                   1 = an affected version or an indicator was found.
  version          print the script version.

Environment: HUNT_ADMIN_SINCE (default 2026-10-01): super-user accounts modified
since this date are flagged for review.
Containers: with no directory argument the check also copies the files it reads from running
docker and podman containers (SCAN_CONTAINERS=1, the default; 0 skips them) and judges them like
host installs. The copies are temporary: a path shown as .../docker_NAME_PATH is the PATH inside
the container NAME.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.