CVE-2026-42613

Critical

Published: 11/05/2026(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Grav is a file-based web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields from the registration POST data without server-side validation.

Risk Assessment

An unauthenticated user can self-register with admin.super privileges, posing a serious security risk to the system.

Recommendation

It is recommended to upgrade to version 2.0.0-beta.2 or later to mitigate this vulnerability.

Original NVD description (English source)

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields from the registration POST data without server-side validation. When registration is enabled and groups or access are included in the configured allowed fields list, an unauthenticated user can self-register with admin.super privileges by injecting these fields into the registration request. This vulnerability is fixed in 2.0.0-beta.2.