The vulnerability occurs in the Grav Login plugin before version 2.0.0‑beta.2. The register() method accepts groups and access values from the registration POST request without server‑side validation, enabling an attacker to inject admin.super privileges during self‑registration. As a result, an unauthenticated user can create an account that already has super‑administrator rights, providing a complete privilege escalation. The flaw is a classic input validation and authorization failure (CWE‑20 and CWE‑862).

The issue impacts Grav CMS, the file‑based web platform, in all releases prior to 2.0.0‑beta.2. It affects the Login plugin component in those versions. Any Grav instance that has user registration enabled and lists groups or access in the allowed fields configuration is vulnerable.

The CVSS score is 9.4, marking the flaw as critical. The vulnerability is remotely exploitable by sending an unauthenticated HTTP POST to the registration endpoint, provided that registration is enabled and the application permits groups or access fields in the registration form. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, yet the combination of lack of validation and potential for granting admin privileges makes it a high‑risk exposure.