Grav Login Plugin Privilege Escalation via Unlock Handler

Executive Summary

CVE-2026-56710 is a privilege escalation flaw in the Grav Login plugin versions before 1.0.16. The vulnerability occurs because the plugin fails to check the privilege level of the target account when handling unlock requests. An attacker with api.users.write permission can exploit this to clear login lockout counters on admin.super accounts, removing brute-force protection from the highest-privilege accounts without needing equivalent permissions.

Useful 0 Not Useful 0

Detection Guidance

Check Grav Login plugin version with: grep -r 'login_plugin' /path/to/grav/ | grep -v '1.0.16' or via Grav admin panel. Look for unauthorized unlock actions in logs targeting admin.super accounts with api.users.write permissions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with limited permissions to bypass security measures protecting admin.super accounts. By clearing lockout counters, attackers can repeatedly attempt to guess credentials for the most privileged accounts, potentially gaining unauthorized access to critical administrative functions and sensitive data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by allowing unauthorized access to high-privilege accounts, potentially leading to data breaches or unauthorized modifications. GDPR requires protection of personal data, and HIPAA mandates secure access to sensitive health information. The flaw enables attackers to bypass brute-force protection on admin.super accounts, increasing the risk of unauthorized system access.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Grav Login plugin to version 1.0.16 or later immediately. Review user permissions to ensure no unauthorized accounts have api.users.write access. Monitor admin.super account activity for unusual unlock patterns.

Useful 0 Not Useful 0