{"schema":"threatline.record/2","record":{"id":"GHSA-j8jx-ccrg-m7h2","aliases":["GHSA-j8jx-ccrg-m7h2"],"summary":"Page author can create a super user account through a Login invitation form","details":"## Summary\n\nThe Login plugin's invitation form task (`login.invite`) sent invitations without checking who submitted the form, and took the new account's access straight from the page's frontmatter with no limit. A user who could author a page could define an invitation form that grants super access, submit it without signing in, and register the invited address as a super user.\n\n## Affected versions\n\nLogin 3.6.0 through 3.9.12. The invitation feature was added in 3.6.0. The plugin runs on both Grav 1.7 and 2.x, and the fixed release covers both.\n\n## Details\n\n`Controller::taskInvite()` required only that a form was active on the page. Any visitor who can load the page can submit its form, so this was not a check on the sender. The task then read `form.meta.invite.account` from the page and stored it in the invitation as the access for the new account, with no cap on what could be granted. An invitation sent by an anonymous visitor was recorded with no issuer.\n\nRegistration with a valid invitation token works when public registration is turned off, and it copies the invitation's account settings into the new user.\n\nThe Invitations API in the API plugin already required `api.users.write` and removed super access and groups for non-super senders. The page form task had neither control.\n\nThe original report presents the Pages API accepting a `form` block from a non-super author and the missing check in the Login plugin as equal parts of the issue. The missing check is the defect: any page carrying an invitation form could be submitted by anyone, and the grant was never capped.\n\n## Impact\n\nAn account limited to writing pages can obtain a separate account with super access, and with it full control of the site. No administrator has to take part. The attacker needs the invitation email to reach an address they control.\n\n## Patches\n\nFixed in Login 3.9.13. An invitation form can only be sent by a signed-in user who manages accounts (`admin.users` or `api.users.write`, or a super user), whatever the page's own `access` says. Only a super user can invite someone into super access or into groups; for anyone else those are removed from the invitation.\n\nSites whose invitation page was restricted with `access: admin.login`, as the README example previously showed, should note that the sender now needs an account management permission.\n\n## Credits\n\nReported by @ffasterss and @shirabe0x05 of Omoikane Labs.\n","categories":["Unclassified"],"product":"getgrav/grav-plugin-login","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/getgrav/grav/security/advisories/GHSA-j8jx-ccrg-m7h2","source_modified_at":"2026-10-07T03:04:12Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"ecosystem":"composer","name":"getgrav/grav-plugin-login"},"range":">= 3.6.0, < 3.9.13"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/getgrav/grav/security/advisories/GHSA-j8jx-ccrg-m7h2","source_modified_at":"2026-10-07T03:04:12Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"ecosystem":"composer","name":"getgrav/grav-plugin-login"},"version":"3.9.13"}],"cvss":null,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-07T03:04:12Z","modified_at":"2026-10-07T03:04:12Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/getgrav/grav/security/advisories/GHSA-j8jx-ccrg-m7h2","fetched_at":"2026-10-23T18:55:00.935475Z","source_modified_at":"2026-10-07T03:04:12Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-07T03:04:12Z","content_hash":"029827db05a0f5df99a23e88fe08358bc18bb144186919f7f7c2cc4546f3b690"}}