LeakyCreds
NewInstant webhook alerts now available — notified within seconds of any credential detection.Learn more →
Home / Vulnerability Intelligence / CVE-2026-42613

CVE-2026-42613 - Vulnerability Analysis

CriticalCVSS: 9.4

Last Updated: May 12, 2026

Grav Login - Broken Access Control

Published: May 11, 2026Updated: May 12, 2026Remote Exploitable

Overview

Grav < 2.0.0-beta.2 contains a broken access control vulnerability caused by lack of server-side validation in Login::register() method, letting unauthenticated users self-register with admin.super privileges by injecting groups or access fields.

Severity & Score

Severity: Critical
CVSS Score: 9.4
EPSS Score: 5.4%(Probability of exploitation in next 30 days)

Impact

Unauthenticated attackers can gain admin.super privileges, leading to full system compromise.

Mitigation

Update to version 2.0.0-beta.2 or later.

References

Social Media Activity(4 posts)

OffSequence
OffSequence
@offseq
May 12, 2026

⚠️ CRITICAL: Grav CMS Login plugin (<2.0.0-beta.2) has a flaw in input validation — unauthenticated attackers can self-register as admin.super if registration is enabled. Patch to 2.0.0-beta.2+ or disable registration! CVE-2026-42613 https://radar.offseq.com/threat/cve-2026-42613-cwe-20-improper-input-validation-in-0960c87a #OffSeq #Grav #Infosec

View original post
TheHackerWire
TheHackerWire
@thehackerwire
May 11, 2026

🔴 CVE-2026-42613 - Critical (9.4) Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields from the registration POST data without server-side validation. When registration is en... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42613/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post
OffSequence
OffSequence
@offseq
May 12, 2026

⚠️ CRITICAL: Grav CMS Login plugin (<2.0.0-beta.2) has a flaw in input validation — unauthenticated attackers can self-register as admin.super if registration is enabled. Patch to 2.0.0-beta.2+ or disable registration! CVE-2026-42613 https://radar.offseq.com/threat/cve-2026-42613-cwe-20-improper-input-validation-in-0960c87a #OffSeq #Grav #Infosec

View original post
TheHackerWire
TheHackerWire
@thehackerwire
May 11, 2026

🔴 CVE-2026-42613 - Critical (9.4) Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields from the registration POST data without server-side validation. When registration is en... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42613/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

Details

CVE ID
CVE-2026-42613
Severity
Critical
CVSS Score
9.4
Type
broken_access_control
Status
rejected
EPSS
5.4%
Social Posts
4

CWE

  • CWE-20

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

EPSS Score

5.4%Probability of exploitation in the next 30 days