CVE-2026-65603
Received Received - Intake

Privilege Escalation in Grav Login Plugin

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: VulnCheck

Description
The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the registration handler, this handler does not strip privilege fields ('groups','access') from user-submitted form data before persisting them. When an administrator has added 'groups' and/or 'access' to plugins.login.user_registration.fields and the default 'regular'/DataUser account backend is in use, a low-privilege authenticated user can POST crafted profile form data (e.g. access[admin][super]=true) to escalate to super-admin, enabling admin panel access, scheduler abuse (RCE), and Twig evaluation. Fixed in 3.8.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-65603
EUVD
EUVD-2026-47647

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
getgrav grav_login_plugin to 3.8.12 (exc)
grav login_plugin to 3.8.11 (inc)
grav login_plugin 3.8.12

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-65603 is a privilege escalation flaw in the Grav Login plugin versions 3.8.11 and earlier. The vulnerability exists in the profile self-update handler which fails to remove privilege-related fields like 'groups' and 'access' from user-submitted form data before saving. This allows low-privilege authenticated users to craft malicious requests to escalate their privileges to super-admin, gaining full administrative access.

Detection Guidance

Check Grav CMS version with: grep -r "version" /var/www/html/user/plugins/login/login.yaml. If version <= 3.8.11, the system is vulnerable. Inspect plugins.login.user_registration.fields in Grav config for 'groups' or 'access' entries. Monitor HTTP POST requests to /user/profile for attempts to set access[admin][super]=true.

Commands: curl -s http://<grav-url>/user/plugins/login/login.yaml | grep version. Check config: grep -r "user_registration.fields" /var/www/html/user/config/plugins/login.yaml.

Impact Analysis

An attacker with low-level access can escalate privileges to super-admin, gaining control over the admin panel, enabling scheduler abuse for remote code execution, and allowing Twig template evaluation. This could lead to full system compromise, data theft, or unauthorized actions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Full administrative access may result in data breaches, unauthorized modifications, or data exfiltration, all of which are compliance violations.

Mitigation Strategies

Upgrade Grav Login plugin to version 3.8.12 or later immediately. Remove 'groups' and 'access' from plugins.login.user_registration.fields in Grav configuration. Temporarily restrict write access to user profile files until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65603. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart