Grav Critical Vulnerability Allows Unauthenticated Admin Access
A critical vulnerability, tracked as CVE-2026-42613, exists in Grav, a popular file-based web platform. The National Vulnerability Database reports that prior to version 2.0.0-beta.2, the Login::register() method within Grav’s Login plugin fails to adequately validate attacker-controlled groups and access fields during user registration. This oversight creates a severe security flaw.
When user registration is enabled and the groups or access fields are configured as allowed, an unauthenticated attacker can inject these fields into a registration request. This allows them to self-register with admin.super privileges, effectively granting them full administrative control over the Grav instance. The National Vulnerability Database assigns this a CVSS score of 9.4 (Critical), highlighting the ease of exploitation and severe impact.
This is a straight-up authentication bypass that hands the keys to your system to anyone who bothers to register. It’s not some complex chain; it’s a fundamental flaw in input validation. Any organization running Grav needs to take this seriously and patch immediately. The fix is in version 2.0.0-beta.2.
What This Means For You
- If your organization uses Grav, you need to check your version immediately. This isn't a theoretical flaw; it's a direct path to full administrative compromise for any unauthenticated user. Patch to Grav 2.0.0-beta.2 or later to mitigate CVE-2026-42613. Furthermore, audit your Grav user logs for any suspicious new `admin.super` accounts created recently, especially if they weren't provisioned through official channels.
Related ATT&CK Techniques
🛡️ Detection Rules
2 rules · 6 SIEM formats2 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
Grav Unauthenticated Admin Registration via Login Plugin - CVE-2026-42613
title: Grav Unauthenticated Admin Registration via Login Plugin - CVE-2026-42613
id: scw-2026-05-11-ai-1
status: experimental
level: critical
description: |
Detects attempts to exploit CVE-2026-42613 by targeting the Grav login registration endpoint. This vulnerability allows unauthenticated users to register with administrative privileges by manipulating POST data to include 'groups' or 'access' fields when registration is enabled and these fields are allowed. This rule specifically looks for POST requests to '/login' paths that contain 'register' in the URI, indicative of the registration process being triggered.
author: SCW Feed Engine (AI-generated)
date: 2026-05-11
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-42613/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/login'
cs-method:
- 'POST'
uri|contains:
- 'register'
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-42613 | Privilege Escalation | Grav CMS Login Plugin < 2.0.0-beta.2 |
| CVE-2026-42613 | Auth Bypass | Grav CMS Login Plugin, Login::register() method |
| CVE-2026-42613 | Misconfiguration | Grav CMS Login Plugin, registration enabled with 'groups' or 'access' in allowed fields |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 11, 2026 at 19:17 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
OpenClaw Improper Authentication: CVE-2026-8305 Publicly Exploitable
CVE-2026-8305 — A vulnerability was detected in OpenClaw up to 2026.1.24. The impacted element is the function handleBlueBubblesWebhookRequest of the file extensions/bluebubbles/src/monitor.ts of the component...
OpenClaw Improper Access Control Bypasses Denylist, Allows Persistent Malicious Configs
CVE-2026-45006 — OpenClaw before 2026.4.23 contains an improper access control vulnerability in the gateway tool's config.apply and config.patch operations that allows compromised models to write...
OpenClaw RCE: Arbitrary Code Execution via Plugin Setup Resolver
CVE-2026-45004 — OpenClaw before 2026.4.23 contains an arbitrary code execution vulnerability in the bundled plugin setup resolver that loads setup-api.js from process.cwd() during provider setup...