The Grav Login plugin contains a missing authorization flaw in the login.invite task that lets page authors create super‑user accounts. Attackers can add an invitation form that grants full site control to a specified email address in a page's frontmatter, submit the form without authentication, and register that address to obtain super‑user privileges.

The vulnerability affects versions of the Grav Login plugin from 3.6.0 up to but not including 3.9.13. Any Grav installation deploying one of those plugin versions is susceptible, especially sites where page authors have permission to edit frontmatter or add invitation forms.

The flaw carries a CVSS score of 8.7, indicating high severity. EPSS data is not available and the issue is not listed in CISA KEV. An attacker can exploit the vulnerability through the public login.invite interface, submitting an invitation form that grants super access without authentication. Because the plugin does not perform an authorization check, a page author can create a new super‑user account and gain full control over the site.