CVE-2026-42613: Grav Login Plugin: Self-Registration Privilege Escalation via Unvalidated Fields

Overview

Grav is a file-based web platform. CVE-2026-42613 concerns the Login::register() method of the Login plugin. According to the record, this method accepts groups and access values from registration POST data without server-side validation. The record classifies the weakness as CWE-20, Improper Input Validation.

Impact

• When registration is enabled and groups or access are included in the configured allowed fields list, an unauthenticated user may be able to self-register with admin.super privileges.
• The CNA reports a CVSS 3.1 base score of 9.4 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, which reflects high confidentiality and integrity impact and low availability impact.

Affected products and versions

• Product: Grav, specifically the Login plugin.
• The record describes the affected range as versions prior to 2.0.0-beta.2.
• The structured affected list in the record is empty, so the exact affected range beyond that description is unknown.
• The record states the fix is available in 2.0.0-beta.2.

Exploitation status

• CISA KEV does not list this CVE in the record, so active exploitation is not confirmed by that source.
• No confirmed exploitation appears in the sources consulted.
• The EPSS probability recorded is 0.00558, with a percentile of 0.44979.

Remediation and mitigation

• Update Grav and the Login plugin to 2.0.0-beta.2 or later, as stated in the record. Review the linked advisories and the plugin commit for component-specific details.
• If public self-registration is not required, disable it in the Login plugin configuration.
• As a temporary measure, remove groups and access from the allowed registration fields list. This is an inference from the description, not a vendor-stated workaround.
• Review existing accounts for unexpected admin.super group membership and reset credentials where suspicious accounts are found.

Detection guidance

• Audit recently created user accounts, especially those assigned to administrative groups without a documented approval.
• Review web server and application logs for registration requests that include group or access parameters, focusing on requests from unauthenticated sources.
• Alert on changes to privilege assignments in user account files or the administration interface.

Limitations of the available information

• The record has no title, an empty affected products list and an empty fixes list, so version boundaries rely on the description alone.
• The record shows a source status of Deferred and does not include the advisory text itself.
• The EPSS date in the record (2026-10-13) is later than the publication date (2026-05-11), so its timing should be treated with caution.
• No independent proof-of-concept details or exploitation reports were available in the consulted record.

Frequently asked questions

What is CVE-2026-42613?

It is a vulnerability in the Login plugin of the Grav platform in which Login::register() accepts groups and access values from registration data without server-side validation.

Which versions are affected?

The record describes versions prior to 2.0.0-beta.2. The structured affected list is empty, so the precise range beyond that description is unknown.

Is this vulnerability known to be actively exploited?

CISA KEV does not list it in the record, and no confirmed exploitation appears in the sources consulted.

What should administrators do?

Update to 2.0.0-beta.2 or later, disable public registration if it is not needed, remove groups and access from the allowed fields list as a temporary measure, and audit accounts for unexpected admin.super membership.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.