Grav Login Plugin Privilege Escalation via Unvalidated Registration Fields

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields from the registration POST data without server-side validation. When registration is enabled and groups or access are included in the configured allowed fields list, an unauthenticated user can self-register with admin.super privileges by injecting these fields into the registration request. This vulnerability is fixed in 2.0.0-beta.2.

Casky was already ahead

This CVE exploits attack patterns that Casky's 412matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Grav CMS versions prior to 2.0.0-beta.2 contain a critical privilege escalation vulnerability in the Login plugin's registration functionality. The vulnerability stems from insufficient input validation on the groups and access fields during user self-registration. When these fields are included in the allowed registration parameters, attackers can inject arbitrary values—specifically admin.super privileges—directly into POST registration requests without server-side verification. This affects any Grav deployment with registration enabled and these fields exposed, allowing complete system compromise through a simple unauthenticated registration request. The vulnerability bypasses fundamental access control mechanisms that should prevent privilege elevation during account creation.

Casky's 412 mapped skills leverage Claude AI's extended reasoning to detect the attack patterns underlying this CVE across the MITRE ATT&CK framework. Practitioners would identify suspicious registration activity through Initial Access (TA0001) detections flagging unusual registration parameters containing privilege escalations. Persistence (TA0003) skills would surface suspicious user accounts created with admin.super roles outside normal workflows. Privilege Escalation (TA0004) techniques would specifically catch the injection of elevated group memberships in registration POST data, while Defense Evasion (TA0005) skills would identify attempts to bypass validation logic. Discovery (TA0007) patterns would reveal reconnaissance of registration endpoints and allowed field configurations. By correlating these techniques, practitioners gain visibility into the full attack chain—from initial registration exploitation through privilege escalation to persistence—enabling rapid detection and response before attackers establish administrative control.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

412 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-42613.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0004 TA0006

Investigate the attack patterns behind CVE-2026-42613

Casky has 412 skills that investigate the attack patterns behind CVE-2026-42613. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn